CVE-2026-71434

Received Received - Intake

Improper File Upload in Statamic CMS

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow through a form's assets or files field, and for assets fields, files could be stored on a public, web-accessible disk, though the application's global upload allowlist still blocked executable types such as .php and .html. This issue is fixed in versions 5.74.3 and 6.24.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-71434

Affected Vendors & Products

Vendor	Product	Version / Range
statamic	statamic	to 6.24.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

Statamic is a content management system. Prior to versions 5.74.3 and 6.24.2, public frontend forms did not enforce file upload restrictions set in the Control Panel. This allowed unauthenticated users to upload disallowed file types via assets or files fields. While global upload allowlists still blocked executables like .php and .html, other unintended files could be uploaded.

Detection Guidance

Check Statamic version for outdated installations. Inspect uploaded files in public directories for unexpected file types. Review form configurations for file upload restrictions. Look for unauthorized files in web-accessible storage paths.

Impact Analysis

An attacker could upload files that bypass intended restrictions, potentially leading to unauthorized content on your site. For assets fields, files might be stored in public web-accessible locations, increasing exposure. This could result in data leaks, defacement, or other security issues depending on the uploaded content.

Compliance Impact

This vulnerability could lead to unauthorized file uploads, potentially violating data integrity and confidentiality requirements under GDPR or HIPAA. If sensitive data is exposed or modified due to unauthorized uploads, compliance could be compromised, leading to legal or regulatory penalties.

Mitigation Strategies

Upgrade Statamic to version 5.74.3 or 6.24.2 or later. Review and enforce file upload restrictions in all public forms. Audit existing uploads for unauthorized files. Ensure global upload allowlist blocks executable types like .php and .html.

Hi! I’m here to help you understand CVE-2026-71434. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70