---
id: CVE-2026-49287
title: >-
  Statamic CMS's unsafe method invocation via collection sorting allows data
  destruction
summary: >-
  Statamic CMS's unsafe method invocation via collection sorting allows data
  destruction
severity: high
cvss: 7.4
cwe:
  - CWE-470
vendor: statamic
product: statamic/cms
ecosystem: composer
affected:
  - statamic/cms < 5.73.23
  - 'statamic/cms >= 6.0.0, < 6.20.0'
patched:
  - statamic/cms 5.73.23
  - statamic/cms 6.20.0
published: '2026-06-26'
updated: '2026-06-26'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-m92m-r54r-x8r2'
references:
  - url: 'https://github.com/statamic/cms/security/advisories/GHSA-4jjr-vmv7-wh4w'
  - url: 'https://github.com/statamic/cms/security/advisories/GHSA-m92m-r54r-x8r2'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-49287'
  - url: 'https://github.com/advisories/GHSA-m92m-r54r-x8r2'
tags:
  - ghsa
  - composer
epss: 0.00457
epssPercentile: 0.3694
ingestedAt: '2026-06-29T13:24:35.100Z'
---

## Overview

### Impact

The fix for GHSA-4jjr-vmv7-wh4w was incomplete. It addressed the issue in the query builder, but the same protection was not applied to in-memory collection sorting. Manipulating sort parameters could result in the loss of content and assets.

This requires a front-end template that passes request input into a tag's sort parameter. It is not exploitable by default — a template would need to be explicitly set up to sort by a visitor-controlled value.

### Patches

This has been fixed in 5.73.23 and 6.20.0.

## Affected packages

- `statamic/cms < 5.73.23`
- `statamic/cms >= 6.0.0, < 6.20.0`

## Remediation

Upgrade to a patched release:

- `statamic/cms 5.73.23`
- `statamic/cms 6.20.0`