Security: statamic/cms
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Sensitive configuration values exposed to content editors via Antlers-enabled fieldsGHSA-gcqf-5x9f-hq7f published
Mar 24, 2026 by jasonvargaModerate -
Missing authorization in revision controllers allows unauthorized content accessGHSA-4hp7-3wxg-cv9q published
Mar 24, 2026 by jasonvargaModerate -
Path traversal in file dictionary fieldtypeGHSA-qm7r-wwq7-6f85 published
Mar 17, 2026 by jasonvargaModerate -
Missing authorization check on taxonomy term creation via fieldtypeGHSA-wh3h-gvc4-cc2g published
Mar 17, 2026 by jasonvargaModerate -
Stored XSS via SVG Sanitization BypassGHSA-7rcv-55mj-chg7 published
Mar 17, 2026 by jasonvargaHigh -
Privilege escalation via stored cross-site scriptingGHSA-hcch-w73c-jp4m published
Mar 12, 2026 by jasonvargaModerate -
Privilege escalation via stored cross-site scriptingGHSA-5vrj-wf7v-5wr7 published
Feb 27, 2026 by jasonvargaHigh -
Missing authorization allows access to email addressesGHSA-w878-f8c6-7r63 published
Feb 27, 2026 by jasonvargaModerate -
Remote code execution via Antlers-enabled control panel inputsGHSA-cpv7-q2wx-m8rw published
Feb 27, 2026 by jasonvargaHigh -
Server-Side Request Forgery via GlideGHSA-cwpp-325q-2cvp published
Feb 27, 2026 by jasonvargaModerate