CVE-2023-48217

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Statamic is a flat-first, Laravel + Git powered CMS designed for building websites. In affected versions certain additional PHP files crafted to look like images may be uploaded regardless of mime type validation rules. This affects front-end forms using the "Forms" feature, and asset upload fields in the control panel. Malicious users could leverage this vulnerability to upload and execute code. This issue has been patched in versions 3.4.14 and 4.34.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Nov 14, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-482185.3The Strapi Protected Populate Plugin protects `get` endpoints from revealing too much information. Prior to version 1.3.4, users were able tCVE-2023-482196.1TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo/redo CVE-2023-48227.2Grafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several organizations,CVE-2023-482207.4Decidim is a participatory democracy framework. Starting in version 0.4.rc3 and prior to version 2.0.9 of the `devise_invitable` gem, the inCVE-2023-482218.8wire-avs provides Audio, Visual, and Signaling (AVS) functionality sure the secure messaging software Wire. Prior to versions 9.2.22 and 9.3CVE-2023-482225.4Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In affected versions access to two URLs usCVE-2023-482235.9fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to version 3.3.2, the fast-jwt library does not properly prevent JWT algorCVE-2023-482249.1Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and theCVE-2023-482259.1Laf is a cloud development platform. Prior to version 1.0.0-beta.13, the control of LAF app enV is not strict enough, and in certain scenariCVE-2023-482263.5OpenReplay is a self-hosted session replay suite. In version 1.14.0, due to lack of validation Name field - Account Settings (for registratiCVE-2023-482274.3Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.3.0, BackoffiCVE-2023-482289.8authentik is an open-source identity provider. When initialising a oauth2 flow with a `code_challenge` and `code_method` (thus requesting PK
CVE-2023-48217: High severity, CVSS 8.8 | Vulnix