CVE-2026-33886
Information Disclosure via Config Injection in Statamic CMS Antlers Fields
Publication date: 2026-03-27
Last updated on: 2026-04-08
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| statamic | statamic | From 5.73.12 (inc) to 5.73.16 (exc) |
| statamic | statamic | From 6.5.0 (inc) to 6.7.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-33886 is a vulnerability in the Statamic content management system that allows a control panel user with access to Antlers-enabled fields to expose sensitive application configuration values. This happens because such users can insert configuration variables directly into their content, which then reveals sensitive information that should not be accessible.
The vulnerability affects versions starting from 5.7.12 up to but not including 5.73.16, and versions from 6.5.0 up to but not including 6.7.2. It has been fixed in versions 5.73.16 and 6.7.2.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of sensitive application configuration information. Since the confidentiality impact is high, attackers or unauthorized users with limited privileges can gain access to sensitive data that could be used for further attacks or exploitation.
The attack requires network access and low privileges, but no user interaction, making it relatively easy to exploit if an attacker has control panel access to Antlers-enabled fields.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves a control panel user inserting configuration variables into Antlers-enabled fields to expose sensitive application configuration values. Detection would involve monitoring for unusual or unauthorized access to Antlers-enabled fields or suspicious content containing configuration variables.
Since the vulnerability is exploited via the control panel interface, network detection could focus on monitoring HTTP requests to the control panel endpoints for suspicious payloads containing configuration variable insertions.
No specific commands or detection scripts are provided in the available resources.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade the Statamic CMS to a patched version. Specifically, update to version 5.73.16 or later in the 5.x series, or version 6.7.2 or later in the 6.x series.
Restrict control panel user access to Antlers-enabled fields to trusted users only, as the vulnerability requires control panel user privileges.
Monitor and audit control panel activity for any suspicious insertion of configuration variables into content.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows a control panel user to expose sensitive application configuration values, leading to unauthorized disclosure of sensitive information.
Such unauthorized exposure of sensitive data could potentially impact compliance with data protection standards and regulations like GDPR and HIPAA, which require safeguarding sensitive information against unauthorized access.
However, the provided information does not explicitly detail the direct effects on compliance with these standards.