CVE-2023-48701

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Statamic CMS is a Laravel and Git powered content management system (CMS). Prior to versions 3.4.15 an 4.36.0, HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the "Forms" feature containing an assets field, or within the control panel which requires authentication. This issue has been patched on 3.4.15 and 4.36.0.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
statamic	cms	< 3.4.15; >= 4.0.0, < 4.36.0

References

https://github.com/statamic/cms/releases/tag/v3.4.15Release Notes
https://github.com/statamic/cms/releases/tag/v4.36.0Release Notes
https://github.com/statamic/cms/security/advisories/GHSA-8jjh-j3c2-cjcvVendor Advisory
https://github.com/statamic/cms/releases/tag/v3.4.15Release Notes
https://github.com/statamic/cms/releases/tag/v4.36.0Release Notes
https://github.com/statamic/cms/security/advisories/GHSA-8jjh-j3c2-cjcvVendor Advisory

Timeline

Published: Nov 21, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-487027.2Jellyfin is a system for managing and streaming media. Prior to version 10.8.13, the `/System/MediaEncoder/Path` endpoint executes an arbitr CVE-2023-487037.5RobotsAndPencils go-saml, a SAML client library written in Go, contains an authentication bypass vulnerability in all known versions. This i CVE-2023-487047.5ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap CVE-2023-487055.4Nautobot is a Network Source of Truth and Network Automation Platform built as a web application All users of Nautobot versions earlier than CVE-2023-487064.7Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a `:s` command for the very fi CVE-2023-487076.5CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. The `secretKey` value is an important key for HMAC SHA CVE-2023-487086.5CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. In affected versions successful login attempts are rec CVE-2023-487098.0iTop is an IT service management platform. When exporting data from backoffice or portal in CSV or Excel files, users' inputs may include m CVE-2023-48719.8A vulnerability classified as critical was found in SourceCodester Contact Manager App 1.0. This vulnerability affects unknown code of the f CVE-2023-487109.8iTop is an IT service management platform. Files from the `env-production` folder can be retrieved even though they should have restricted CVE-2023-487113.7google-translate-api-browser is an npm package which interfaces with the google translate web api. A Server-Side Request Forgery (SSRF) Vuln CVE-2023-487128.8Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. In affected versions there is a privilege escalation vulnerability t