# statamic/cms (Packagist) vulnerabilities Source: https://junglewise.ai/threats/technologies/statamic-cms Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/statamic-cms.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 44 vulnerabilities in statamic/cms (Packagist): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-71435, was published on 6 August 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 44 (0 critical, 0 exploited in the wild) ## About statamic/cms (Packagist) Flat-file and database-driven headless CMS built on Laravel for PHP. ## Latest statamic/cms (Packagist) vulnerabilities - [CVE-2026-71435: Statamic CMS stored XSS in form notification email template](https://junglewise.ai/threats/cve-2026-71435-statamic-cms-stored-xss-in-form-notification-email-template) (medium, CVSS 6.1, published 6 Aug 2026) - [CVE-2026-71434: Statamic CMS unrestricted file upload in frontend forms](https://junglewise.ai/threats/cve-2026-71434-statamic-cms-unrestricted-file-upload-in-frontend-forms) (medium, CVSS 5.3, published 6 Aug 2026) - [CVE-2026-64665: Statamic CMS account takeover via OAuth email matching](https://junglewise.ai/threats/cve-2026-64665-statamic-cms-account-takeover-via-oauth-email-matching) (high, CVSS 8.1, published 6 Aug 2026) - [CVE-2026-64664: Statamic CMS missing authorization in Control Panel user wizard](https://junglewise.ai/threats/cve-2026-64664-statamic-cms-missing-authorization-in-control-panel-user-wizard) (medium, CVSS 4.3, published 6 Aug 2026) - [CVE-2026-64663: Statamic CMS unsafe reflection in Antlers template resolution](https://junglewise.ai/threats/cve-2026-64663-statamic-cms-unsafe-reflection-in-antlers-template-resolution) (medium, CVSS 6.5, published 6 Aug 2026) - [CVE-2026-64662: Statamic CMS missing authorization in navigation endpoint](https://junglewise.ai/threats/cve-2026-64662-statamic-cms-missing-authorization-in-navigation-endpoint) (medium, CVSS 6.5, published 6 Aug 2026) - [CVE-2026-71293: Statamic CMS two-factor recovery code exposure in Antlers templates](https://junglewise.ai/threats/cve-2026-71293-statamic-cms-two-factor-recovery-code-exposure-in-antlers) (medium, CVSS 6.2, published 5 Aug 2026) - [CVE-2026-54244: Statamic CMS incorrect authorization in Live Preview](https://junglewise.ai/threats/cve-2026-54244-statamic-cms-incorrect-authorization-in-live-preview) (low, CVSS 3.5, published 17 Jul 2026) - [CVE-2026-54243: Statamic CMS CSV injection in form submission exports](https://junglewise.ai/threats/cve-2026-54243-statamic-cms-csv-injection-in-form-submission-exports) (medium, CVSS 6.1, published 17 Jul 2026) - [CVE-2026-54242: Statamic CMS SSRF via DNS rebinding in Glide image proxy](https://junglewise.ai/threats/cve-2026-54242-statamic-cms-ssrf-via-dns-rebinding-in-glide-image-proxy) (medium, CVSS 4.9, published 17 Jul 2026) - [CVE-2026-49288: Statamic CMS incorrect authorization in Control Panel fieldtype endpoints](https://junglewise.ai/threats/cve-2026-49288-statamic-cms-incorrect-authorization-in-control-panel-fieldtype) (medium, CVSS 4.3, published 19 Jun 2026) - [CVE-2026-49287: Statamic CMS unsafe reflection in collection sorting](https://junglewise.ai/threats/cve-2026-49287-statamic-cms-unsafe-reflection-in-collection-sorting) (high, CVSS 7.4, published 19 Jun 2026) - [CVE-2026-45660: Statamic CMS SSRF in Glide image proxy](https://junglewise.ai/threats/cve-2026-45660-statamic-cms-ssrf-in-glide-image-proxy) (medium, CVSS 5.4, published 29 May 2026) - [CVE-2026-44306: Statamic CMS user enumeration in forgot password form](https://junglewise.ai/threats/cve-2026-44306-statamic-cms-email-enumeration-in-forgot-password-endpoint) (medium, CVSS 5.3, published 12 May 2026) - [CVE-2026-41175: Statamic: Unsafe method invocation via query value resolution allows data destruction](https://junglewise.ai/threats/cve-2026-41175-statamic-unsafe-method-invocation-via-query-value-resolution) (high, CVSS 8.1, published 22 Apr 2026) - [CVE-2026-33887: Statamic allows unauthorized content access through missing authorization in its revision controllers](https://junglewise.ai/threats/cve-2026-33887-statamic-allows-unauthorized-content-access-through-missing) (medium, CVSS 5.4, published 27 Mar 2026) - [CVE-2026-33886: Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields](https://junglewise.ai/threats/cve-2026-33886-statamic-s-sensitive-configuration-values-are-exposed-to-content) (medium, CVSS 6.5, published 27 Mar 2026) - [CVE-2026-33885: Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential](https://junglewise.ai/threats/cve-2026-33885-statamic-has-an-open-redirect-on-unauthenticated-endpoints-via) (medium, CVSS 6.1, published 27 Mar 2026) - [CVE-2026-33884: Statamic's live preview token bypasses content protection for unrelated entries](https://junglewise.ai/threats/cve-2026-33884-statamic-s-live-preview-token-bypasses-content-protection-for) (medium, CVSS 4.3, published 27 Mar 2026) - [CVE-2026-33883: Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag](https://junglewise.ai/threats/cve-2026-33883-statamic-has-reflected-xss-via-unescaped-redirect-parameter-in) (medium, CVSS 6.1, published 27 Mar 2026) - [CVE-2026-33882: Statamic's Markdown preview endpoint exposes sensitive user data](https://junglewise.ai/threats/cve-2026-33882-statamic-s-markdown-preview-endpoint-exposes-sensitive-user-data) (medium, CVSS 6.5, published 27 Mar 2026) - [CVE-2026-33177: Statamic is missing authorization check on taxonomy term creation via fieldtype](https://junglewise.ai/threats/cve-2026-33177-statamic-is-missing-authorization-check-on-taxonomy-term-creation) (low, CVSS 3.1, published 18 Mar 2026) - [CVE-2026-33171: Statamic has a path traversal in file dictionary fieldtype](https://junglewise.ai/threats/cve-2026-33171-statamic-has-a-path-traversal-in-file-dictionary-fieldtype) (low, CVSS 3.1, published 18 Mar 2026) - [CVE-2026-33172: Statamic has Stored XSS via SVG Sanitization Bypass](https://junglewise.ai/threats/cve-2026-33172-statamic-has-stored-xss-via-svg-sanitization-bypass) (low, CVSS 3.1, published 18 Mar 2026) - [CVE-2026-32612: Statamic vulnerable to privilege escalation via stored cross-site scripting](https://junglewise.ai/threats/cve-2026-32612-statamic-vulnerable-to-privilege-escalation-via-stored-cross-site) (low, CVSS 3.1, published 13 Mar 2026) ## Most severe statamic/cms (Packagist) vulnerabilities - [CVE-2026-64665: Statamic CMS account takeover via OAuth email matching](https://junglewise.ai/threats/cve-2026-64665-statamic-cms-account-takeover-via-oauth-email-matching) (high, CVSS 8.1, published 6 Aug 2026) - [CVE-2026-41175: Statamic: Unsafe method invocation via query value resolution allows data destruction](https://junglewise.ai/threats/cve-2026-41175-statamic-unsafe-method-invocation-via-query-value-resolution) (high, CVSS 8.1, published 22 Apr 2026) - [CVE-2025-64112: Statmatic is a Laravel and Git powered content management system (CMS). Stored XSS vulnerabilities in Collections and…](https://junglewise.ai/threats/cve-2025-64112-statamic-vulnerable-to-superadmin-account-takeover-via-stored) (high, CVSS 8, published 30 Oct 2025) - [CVE-2026-49287: Statamic CMS unsafe reflection in collection sorting](https://junglewise.ai/threats/cve-2026-49287-statamic-cms-unsafe-reflection-in-collection-sorting) (high, CVSS 7.4, published 19 Jun 2026) - [CVE-2026-64662: Statamic CMS missing authorization in navigation endpoint](https://junglewise.ai/threats/cve-2026-64662-statamic-cms-missing-authorization-in-navigation-endpoint) (medium, CVSS 6.5, published 6 Aug 2026) - [CVE-2026-64663: Statamic CMS unsafe reflection in Antlers template resolution](https://junglewise.ai/threats/cve-2026-64663-statamic-cms-unsafe-reflection-in-antlers-template-resolution) (medium, CVSS 6.5, published 6 Aug 2026) - [CVE-2026-33882: Statamic's Markdown preview endpoint exposes sensitive user data](https://junglewise.ai/threats/cve-2026-33882-statamic-s-markdown-preview-endpoint-exposes-sensitive-user-data) (medium, CVSS 6.5, published 27 Mar 2026) - [CVE-2026-33886: Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields](https://junglewise.ai/threats/cve-2026-33886-statamic-s-sensitive-configuration-values-are-exposed-to-content) (medium, CVSS 6.5, published 27 Mar 2026) - [CVE-2026-71293: Statamic CMS two-factor recovery code exposure in Antlers templates](https://junglewise.ai/threats/cve-2026-71293-statamic-cms-two-factor-recovery-code-exposure-in-antlers) (medium, CVSS 6.2, published 5 Aug 2026) - [CVE-2026-71435: Statamic CMS stored XSS in form notification email template](https://junglewise.ai/threats/cve-2026-71435-statamic-cms-stored-xss-in-form-notification-email-template) (medium, CVSS 6.1, published 6 Aug 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Packagist technologies - [moodle/moodle (Packagist)](https://junglewise.ai/threats/technologies/moodle-moodle): 434 vulnerabilities - [magento/community-edition (Packagist)](https://junglewise.ai/threats/technologies/packagist-magento-community-edition): 362 vulnerabilities - [typo3/cms (Packagist)](https://junglewise.ai/threats/technologies/packagist-typo3-cms): 187 vulnerabilities - [wwbn/avideo (Packagist)](https://junglewise.ai/threats/technologies/wwbn-avideo): 164 vulnerabilities - [magento/project-community-edition (Packagist)](https://junglewise.ai/threats/technologies/magento-project-community-edition): 161 vulnerabilities - [drupal/core (Packagist)](https://junglewise.ai/threats/technologies/packagist-drupal-core): 150 vulnerabilities - [pimcore/pimcore (Packagist)](https://junglewise.ai/threats/technologies/pimcore-pimcore): 145 vulnerabilities - [craftcms/cms (Packagist)](https://junglewise.ai/threats/technologies/craftcms-cms): 143 vulnerabilities - [dolibarr/dolibarr (Packagist)](https://junglewise.ai/threats/technologies/dolibarr-dolibarr): 127 vulnerabilities - [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav): 127 vulnerabilities - [typo3/cms-core (Packagist)](https://junglewise.ai/threats/technologies/typo3-cms-core): 127 vulnerabilities - [concrete5/concrete5 (Packagist)](https://junglewise.ai/threats/technologies/concrete5-concrete5): 122 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "statamic/cms (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/statamic-cms, 9 November 2026.