Security: statamic/cms
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Privilege escalation via elevated session bypassGHSA-rw9x-pxqx-q789 published
Feb 27, 2026 by jasonvargaHigh -
Account takeover via password reset link injectionGHSA-jxq9-79vj-rgvw published
Feb 23, 2026 by jasonvargaCritical -
Privilege escalation via stored cross-site scriptingGHSA-8r7r-f4gm-wcpq published
Feb 18, 2026 by jasonvargaHigh -
Privilege escalation via stored cross-site scriptingGHSA-ff9r-ww9c-43x8 published
Feb 11, 2026 by jasonvargaHigh -
Missing authorization allows access to assetsGHSA-gwmx-9gcj-332h published
Feb 11, 2026 by jasonvargaModerate -
Path Traversal in Asset UploadGHSA-p7f6-8mcm-fwv3 published
Nov 19, 2024 by jasonvargaModerate -
Privilege Escalation: Superadmin Account Takeover via Stored Cross-Site ScriptingGHSA-g59r-24g3-h7cm published
Oct 30, 2025 by jasonvargaHigh -
Password confirmation stored in plain text via registration formGHSA-qvpj-w7xj-r6w9 published
May 30, 2024 by jasonvargaLow -
Account takeover via XSS and password reset linkGHSA-vqxq-hvxw-9mv9 published
Feb 1, 2024 by jasonvargaHigh -
XSS via uploaded assetsGHSA-8jjh-j3c2-cjcv published
Nov 21, 2023 by jasonvargaHigh