CVE-2026-71435

Received Received - Intake

HTML Injection in Statamic CMS via Form Notifications

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, the default ("automagic") form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the configured recipients. This issue is fixed in versions 5.74.3 and 6.24.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-71435

Affected Vendors & Products

Vendor	Product	Version / Range
statamic	statamic	to 5.74.3 (inc)
statamic	statamic	to 6.24.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Statamic is a content management system that uses Laravel and Git. A vulnerability exists in versions before 5.74.3 and 6.24.2 where user-submitted form data is rendered in notification emails without proper escaping. This allows an unauthenticated attacker to inject HTML code into these emails.

Detection Guidance

Check your Statamic version against the patched versions (5.74.3 or 6.24.2). Inspect email notification templates for user-submitted data rendering without HTML escaping.

Impact Analysis

An attacker could send malicious HTML via a form, which would then be included in emails sent to configured recipients. This could lead to phishing attacks, credential theft, or other malicious activities if the injected HTML is rendered by the recipient's email client.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or manipulation, potentially violating GDPR's data protection requirements or HIPAA's security rules for protected health information. Organizations using affected versions may face compliance risks if user data is compromised.

Mitigation Strategies

Upgrade Statamic to version 5.74.3 or 6.24.2 or later. Review and update form notification email templates to properly escape user-submitted values.

Hi! I’m here to help you understand CVE-2026-71435. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70