statamic/cms Known Vulnerabilities & Fixes
statamic/cms has 8 known security vulnerabilities in Packagist (PHP). Upgrade to version 6.24.0 or later to resolve all known issues. Data sourced from OSV, enriched with EPSS exploit probability and CISA KEV.
Low Immediate Risk
No actively exploited vulnerabilities detected. Monitor and update in your next maintenance window.
Recommended safe version: 6.24.0
Upgrading to 6.24.0 or later resolves all 8 known vulnerabilities in statamic/cms. Run: composer require statamic/cms:^6.24.0
Is statamic/cms in your project?
Check if you're affected and upgrade to 6.24.0 to stay secure.
Security Summary
- 14 affected version ranges have been identified across these 8 advisories.
- 100% of known issues have a published fixed version.
- Remediation: composer update statamic/cms
Vulnerabilities
8 unique vulnerabilities — sorted by exploitation risk (KEV → EPSS → CVSS). Click a CVE/GHSA ID for full details. First disclosed Feb 11, 2026, most recently Aug 6, 2026 (176 days apart).
| CVE / GHSA | Severity | Affected | Fixed In |
|---|---|---|---|
| CVE-2026-27593 Statamic is vulnerable to account takeover via password reset link injection | CRITICAL | v3.0.0, v3.0.0-beta.1, v3.0.0-beta.10, v3.0.0-beta.11 (+525 more) | 5.73.10, 6.7.1 |
| CVE-2026-41175 Statamic: Unsafe method invocation via query value resolution allows data destruction | HIGH | v3.0.0, v3.0.0-beta.1, v3.0.0-beta.10, v3.0.0-beta.11 (+543 more) | 5.73.20, 6.13.0 |
| CVE-2026-27196 Statamic affected by privilege escalation via stored cross-site scripting | HIGH | v6.0.0, v6.0.0-alpha.1, v6.0.0-alpha.10, v6.0.0-alpha.11 (+514 more) | 6.3.2, 5.73.9 |
| CVE-2026-33172 Statamic has Stored XSS via SVG Sanitization Bypass | HIGH | v6.0.0, v6.0.0-alpha.1, v6.0.0-alpha.10, v6.0.0-alpha.11 (+528 more) | 6.7.0, 5.73.14 |
| CVE-2026-28426 Statamic vulnerable to privilege escalation via stored cross-site scripting | HIGH | v3.0.0, v3.0.0-beta.1, v3.0.0-beta.10, v3.0.0-beta.11 (+518 more) | 5.73.11, 6.4.0 |
| CVE-2026-27939 Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass | HIGH | v6.0.0, v6.1.0, v6.2.0, v6.2.1 (+8 more) | 6.4.0 |
| CVE-2026-25759 Statamic CMS vulnerable to privilege escalation via stored cross-site scripting | HIGH | v6.0.0, v6.1.0, v6.2.0, v6.2.1 (+1 more) | 6.2.3 |
| CVE-2026-64665 Statamic: Account takeover via OAuth email matching without email-verification check | HIGH | v3.0.0, v3.0.0-beta.1, v3.0.0-beta.10, v3.0.0-beta.11 (+537 more) | 5.74.1, 6.24.0 |
About This Data
Vulnerability data for statamic/cms is sourced from the Open Source Vulnerability (OSV) database, aggregating reports from GitHub Advisory Database, NIST NVD, and ecosystem-specific sources.
CVSS (Common Vulnerability Scoring System) scores reflect exploitability and impact. EPSS (Exploit Prediction Scoring System) scores indicate the probability of exploitation within the next 30 days. Vulnerabilities marked with are listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
Related Packagist (PHP) Packages
Other packages in this ecosystem, ranked by shared vulnerabilities where available.
Check Your Dependencies
Scan your project to check if you're using a vulnerable version of statamic/cms.