CVE-2026-71435 statamic CVE debrief

Who should care

Statamic CMS administrators and security teams should assess exposure and prioritize remediation. They should also verify notification email templates for potential HTML injection vulnerabilities and monitor notification emails for suspicious activity. Additionally, they should review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-71435 allows unauthenticated HTML injection in Statamic CMS notification emails. Defenders should verify exposure, prioritize remediation, and monitor for suspicious activity. The issue is fixed in versions 5.74.3 and 6.24.2.

• Potential phishing or social engineering attacks via injected HTML
• Risk of injected JavaScript or CSS in notification emails
• Possible disruption of email-based workflows or communications
• Verification of email template security and user input validation

Technical summary

The Statamic CMS is vulnerable to HTML injection in notification emails due to improper escaping of user-submitted values. This issue allows unauthenticated form submitters to inject HTML into notification emails sent to configured recipients. The vulnerability has not been publicly exploited. There is no evidence of in-the-wild exploitation. Defenders should verify email template security and user input validation. The issue is fixed in versions 5.74.3 and 6.24.2. The CVE record and NVD detail page provide information on the vulnerability in Statamic CMS.

Defensive priority

Medium priority for Statamic CMS administrators and security teams

Recommended defensive actions

• Review and update Statamic CMS to version 5.74.3 or 6.24.2
• Verify notification email templates for potential HTML injection vulnerabilities
• Monitor notification emails for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability in Statamic CMS, which allows unauthenticated form submitters to inject HTML into notification emails. The issue is fixed in versions 5.74.3 and 6.24.2. The vulnerability has not been publicly exploited. There is no evidence of in-the-wild exploitation. Defenders should verify email template security and user input validation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.