These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-71435 debrief based on CVE Program and NVD records. The Statamic CMS is vulnerable to HTML injection in notification emails due to improper escaping of user-submitted values. This issue allows unauthenticated form submitters to inject HTML into notification emails sent to configured recipients. The issue is fixed in versions 5.74.3 and 6.24.2. Defenders should verify exposure, prioritize remediat [truncated]
CVE-2026-71434 is a medium-severity vulnerability in Statamic CMS that allows unauthenticated file uploads, potentially leading to security risks if not mitigated. The issue arises from public frontend forms not enforcing the same file upload restrictions as the Control Panel, allowing files to be stored on a public, web-accessible disk for assets fields. However, the application's global upload allowlist [truncated]
CVE-2026-64665 debrief: Statamic CMS OAuth login vulnerability allows unauthenticated attackers to sign in as existing users, including super admins, without passwords when using providers without verified email guarantees. This issue arises in Statamic CMS versions before 5.74.1 and 6.24.0, where OAuth login is enabled with a provider that does not guarantee verified email addresses. Exploitation require [truncated]
The CVE-2026-71293 vulnerability affects Statamic CMS's AugmentedUser resolver, allowing attackers to obtain 2FA recovery codes via dynamic Antlers template rendering. This vulnerability exists because two_factor_recovery_codes is neither excluded from augmentation nor present in Statamic's Antlers variable guard lists. The likely operational impact includes 2FA bypass and potential unauthorized access to [truncated]
A Control Panel user with view but not edit permission could submit content they were not authorized to author and generate a shareable Live Preview URL rendering it due to insufficient authorization checks in the Live Preview endpoint. This vulnerability affects Statamic CMS versions prior to 5.74.0 and 6.20.3. The issue allows unauthorized content submission and preview, potentially leading to informati [truncated]
CVE-2026-54242 is a medium-severity vulnerability affecting Statamic, a Laravel and Git powered content management system (CMS). The Glide image proxy's URL validation could be bypassed using DNS rebinding, allowing an attacker to make HTTP requests to internal addresses. This vulnerability exists in src/Imaging/RemoteUrlValidator.php and src/Imaging/GuzzleAdapter.php. An attacker controlling the hostname [truncated]
CVE-2026-49287 is a HIGH-severity vulnerability in Statamic CMS, with a CVSS score of 7.4. The issue is an incomplete fix for CVE-2026-41175, allowing for loss of content and assets by manipulating sort parameters in a front-end template. This requires a template explicitly set up to sort by a visitor-controlled value. The vulnerability was published on June 19, 2026, and affects Statamic CMS versions pri [truncated]
Statamic CMS versions prior to 5.73.22 and 6.18.1 contain a Server-Side Request Forgery (SSRF) vulnerability in the Glide image proxy component. The vulnerability exists because URL validation for the Glide image proxy did not properly normalize IP address representations before checking whether they resolve to public IP addresses. This validation bypass allows unauthenticated attackers to supply URLs tha [truncated]