# Statamic vulnerabilities Source: https://junglewise.ai/threats/technologies/statamic Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/statamic.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 19 vulnerabilities in Statamic: 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-71434, was published on 6 August 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 19 (0 critical, 0 exploited in the wild) ## About Statamic Statamic is a PHP-based flat-file and database content management system for building digital experiences. ## Latest Statamic vulnerabilities - [CVE-2026-71434: Statamic CMS unrestricted file upload in frontend forms](https://junglewise.ai/threats/cve-2026-71434-statamic-cms-unrestricted-file-upload-in-frontend-forms) (medium, CVSS 5.3, published 6 Aug 2026) - [CVE-2026-64665: Statamic CMS account takeover via OAuth email matching](https://junglewise.ai/threats/cve-2026-64665-statamic-cms-account-takeover-via-oauth-email-matching) (high, CVSS 8.1, published 6 Aug 2026) - [CVE-2026-64664: Statamic CMS missing authorization in Control Panel user wizard](https://junglewise.ai/threats/cve-2026-64664-statamic-cms-missing-authorization-in-control-panel-user-wizard) (medium, CVSS 4.3, published 6 Aug 2026) - [CVE-2026-64662: Statamic CMS missing authorization in navigation endpoint](https://junglewise.ai/threats/cve-2026-64662-statamic-cms-missing-authorization-in-navigation-endpoint) (medium, CVSS 6.5, published 6 Aug 2026) - [CVE-2026-71293: Statamic CMS two-factor recovery code exposure in Antlers templates](https://junglewise.ai/threats/cve-2026-71293-statamic-cms-two-factor-recovery-code-exposure-in-antlers) (medium, CVSS 6.2, published 5 Aug 2026) - [CVE-2026-54244: Statamic CMS incorrect authorization in Live Preview](https://junglewise.ai/threats/cve-2026-54244-statamic-cms-incorrect-authorization-in-live-preview) (low, CVSS 3.5, published 17 Jul 2026) - [CVE-2026-54243: Statamic CMS CSV injection in form submission exports](https://junglewise.ai/threats/cve-2026-54243-statamic-cms-csv-injection-in-form-submission-exports) (medium, CVSS 6.1, published 17 Jul 2026) - [CVE-2026-54242: Statamic CMS SSRF via DNS rebinding in Glide image proxy](https://junglewise.ai/threats/cve-2026-54242-statamic-cms-ssrf-via-dns-rebinding-in-glide-image-proxy) (medium, CVSS 4.9, published 17 Jul 2026) - [CVE-2026-49288: Statamic CMS incorrect authorization in Control Panel fieldtype endpoints](https://junglewise.ai/threats/cve-2026-49288-statamic-cms-incorrect-authorization-in-control-panel-fieldtype) (medium, CVSS 4.3, published 19 Jun 2026) - [CVE-2026-49287: Statamic CMS unsafe reflection in collection sorting](https://junglewise.ai/threats/cve-2026-49287-statamic-cms-unsafe-reflection-in-collection-sorting) (high, CVSS 7.4, published 19 Jun 2026) - [CVE-2026-45660: Statamic CMS SSRF in Glide image proxy](https://junglewise.ai/threats/cve-2026-45660-statamic-cms-ssrf-in-glide-image-proxy) (medium, CVSS 5.4, published 29 May 2026) - [CVE-2026-44306: Statamic CMS user enumeration in forgot password form](https://junglewise.ai/threats/cve-2026-44306-statamic-cms-email-enumeration-in-forgot-password-endpoint) (medium, CVSS 5.3, published 12 May 2026) - [CVE-2026-41175: Statamic: Unsafe method invocation via query value resolution allows data destruction](https://junglewise.ai/threats/cve-2026-41175-statamic-unsafe-method-invocation-via-query-value-resolution) (high, CVSS 8.1, published 22 Apr 2026) - [CVE-2026-33887: Statamic allows unauthorized content access through missing authorization in its revision controllers](https://junglewise.ai/threats/cve-2026-33887-statamic-allows-unauthorized-content-access-through-missing) (medium, CVSS 5.4, published 27 Mar 2026) - [CVE-2026-33886: Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields](https://junglewise.ai/threats/cve-2026-33886-statamic-s-sensitive-configuration-values-are-exposed-to-content) (medium, CVSS 6.5, published 27 Mar 2026) - [CVE-2026-33885: Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential](https://junglewise.ai/threats/cve-2026-33885-statamic-has-an-open-redirect-on-unauthenticated-endpoints-via) (medium, CVSS 6.1, published 27 Mar 2026) - [CVE-2026-33884: Statamic's live preview token bypasses content protection for unrelated entries](https://junglewise.ai/threats/cve-2026-33884-statamic-s-live-preview-token-bypasses-content-protection-for) (medium, CVSS 4.3, published 27 Mar 2026) - [CVE-2026-33883: Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag](https://junglewise.ai/threats/cve-2026-33883-statamic-has-reflected-xss-via-unescaped-redirect-parameter-in) (medium, CVSS 6.1, published 27 Mar 2026) - [CVE-2026-33882: Statamic's Markdown preview endpoint exposes sensitive user data](https://junglewise.ai/threats/cve-2026-33882-statamic-s-markdown-preview-endpoint-exposes-sensitive-user-data) (medium, CVSS 6.5, published 27 Mar 2026) ## Most severe Statamic vulnerabilities - [CVE-2026-64665: Statamic CMS account takeover via OAuth email matching](https://junglewise.ai/threats/cve-2026-64665-statamic-cms-account-takeover-via-oauth-email-matching) (high, CVSS 8.1, published 6 Aug 2026) - [CVE-2026-41175: Statamic: Unsafe method invocation via query value resolution allows data destruction](https://junglewise.ai/threats/cve-2026-41175-statamic-unsafe-method-invocation-via-query-value-resolution) (high, CVSS 8.1, published 22 Apr 2026) - [CVE-2026-49287: Statamic CMS unsafe reflection in collection sorting](https://junglewise.ai/threats/cve-2026-49287-statamic-cms-unsafe-reflection-in-collection-sorting) (high, CVSS 7.4, published 19 Jun 2026) - [CVE-2026-64662: Statamic CMS missing authorization in navigation endpoint](https://junglewise.ai/threats/cve-2026-64662-statamic-cms-missing-authorization-in-navigation-endpoint) (medium, CVSS 6.5, published 6 Aug 2026) - [CVE-2026-33882: Statamic's Markdown preview endpoint exposes sensitive user data](https://junglewise.ai/threats/cve-2026-33882-statamic-s-markdown-preview-endpoint-exposes-sensitive-user-data) (medium, CVSS 6.5, published 27 Mar 2026) - [CVE-2026-33886: Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields](https://junglewise.ai/threats/cve-2026-33886-statamic-s-sensitive-configuration-values-are-exposed-to-content) (medium, CVSS 6.5, published 27 Mar 2026) - [CVE-2026-71293: Statamic CMS two-factor recovery code exposure in Antlers templates](https://junglewise.ai/threats/cve-2026-71293-statamic-cms-two-factor-recovery-code-exposure-in-antlers) (medium, CVSS 6.2, published 5 Aug 2026) - [CVE-2026-54243: Statamic CMS CSV injection in form submission exports](https://junglewise.ai/threats/cve-2026-54243-statamic-cms-csv-injection-in-form-submission-exports) (medium, CVSS 6.1, published 17 Jul 2026) - [CVE-2026-33885: Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential](https://junglewise.ai/threats/cve-2026-33885-statamic-has-an-open-redirect-on-unauthenticated-endpoints-via) (medium, CVSS 6.1, published 27 Mar 2026) - [CVE-2026-33883: Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag](https://junglewise.ai/threats/cve-2026-33883-statamic-has-reflected-xss-via-unescaped-redirect-parameter-in) (medium, CVSS 6.1, published 27 Mar 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Statamic vulnerabilities", https://junglewise.ai/threats/technologies/statamic, 9 November 2026.