CVE-2026-71434

MediumCVSS 5.3/10Last modified Oct 24, 2026

Description

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow through a form's assets or files field, and for assets fields, files could be stored on a public, web-accessible disk, though the application's global upload allowlist still blocked executable types such as .php and .html. This issue is fixed in versions 5.74.3 and 6.24.2.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
statamic	cms	< 5.74.3; >= 6.0.0, < 6.24.2

References

Timeline

Published: Aug 6, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-714356.1Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, the default ("automagic") form notificati CVE-2026-714365.3Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 10.6.0 until 10.9.8 and CVE-2026-714376.5Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, M CVE-2026-714382.4Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid CVE-2026-714395.3Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.6.0 until 11.16.1, M CVE-2026-71444.3A security flaw has been discovered in 1000 Projects Portfolio Management System MCA 1.0. This impacts an unknown function of the file updat CVE-2026-714405.4Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker CVE-2026-714415.5Illustrator is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage CVE-2026-714427.5CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of CVE-2026-714437.5CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An CVE-2026-714446.2CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of CVE-2026-714458.2AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/add_tags endpoint. When an error occurred while processin