Executive Summary

CVE-2026-33886 is a vulnerability in the Statamic content management system that allows a control panel user with access to Antlers-enabled fields to expose sensitive application configuration values. This happens because such users can insert configuration variables directly into their content, which then reveals sensitive information that should not be accessible.

The vulnerability affects versions starting from 5.7.12 up to but not including 5.73.16, and versions from 6.5.0 up to but not including 6.7.2. It has been fixed in versions 5.73.16 and 6.7.2.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive application configuration information. Since the confidentiality impact is high, attackers or unauthorized users with limited privileges can gain access to sensitive data that could be used for further attacks or exploitation.

The attack requires network access and low privileges, but no user interaction, making it relatively easy to exploit if an attacker has control panel access to Antlers-enabled fields.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a control panel user inserting configuration variables into Antlers-enabled fields to expose sensitive application configuration values. Detection would involve monitoring for unusual or unauthorized access to Antlers-enabled fields or suspicious content containing configuration variables.

Since the vulnerability is exploited via the control panel interface, network detection could focus on monitoring HTTP requests to the control panel endpoints for suspicious payloads containing configuration variable insertions.

No specific commands or detection scripts are provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade the Statamic CMS to a patched version. Specifically, update to version 5.73.16 or later in the 5.x series, or version 6.7.2 or later in the 6.x series.

Restrict control panel user access to Antlers-enabled fields to trusted users only, as the vulnerability requires control panel user privileges.

Monitor and audit control panel activity for any suspicious insertion of configuration variables into content.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows a control panel user to expose sensitive application configuration values, leading to unauthorized disclosure of sensitive information.

Such unauthorized exposure of sensitive data could potentially impact compliance with data protection standards and regulations like GDPR and HIPAA, which require safeguarding sensitive information against unauthorized access.

However, the provided information does not explicitly detail the direct effects on compliance with these standards.

Useful 0 Not Useful 0