---
id: CVE-2026-71434
title: Statamic is a Laravel and Git powered content management system (CMS)
summary: >-
  Statamic is a Laravel and Git powered content management system (CMS). Prior
  to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload
  restrictions that the Control Panel enforces, so an unauthenticated visitor
  could up…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-434
vendor: statamic
product: statamic/cms
affected:
  - statamic/cms < 5.74.3
  - 'statamic/cms >= 6.0.0, < 6.24.2'
patched:
  - statamic/cms 5.74.3
  - statamic/cms 6.24.2
published: '2026-08-06'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:51:43.490'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71434'
references:
  - url: >-
      https://github.com/statamic/cms/commit/8be7b6c961536d3173ec4e0965d17b1cf820b7ae
    label: security-advisories@github.com
  - url: 'https://github.com/statamic/cms/pull/14958'
    label: security-advisories@github.com
  - url: 'https://github.com/statamic/cms/releases/tag/v5.74.3'
    label: security-advisories@github.com
  - url: 'https://github.com/statamic/cms/releases/tag/v6.24.2'
    label: security-advisories@github.com
  - url: 'https://github.com/statamic/cms/security/advisories/GHSA-qhr7-v3xp-vw9m'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-qhr7-v3xp-vw9m'
tags:
  - nvd
  - ghsa
  - composer
epss: 0.00412
epssPercentile: 0.32627
aliases:
  - GHSA-qhr7-v3xp-vw9m
ecosystem: composer
ingestedAt: '2026-08-06T20:03:56.564Z'
---

## Overview

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow through a form's assets or files field, and for assets fields, files could be stored on a public, web-accessible disk, though the application's global upload allowlist still blocked executable types such as .php and .html. This issue is fixed in versions 5.74.3 and 6.24.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-71434)

Affected packages:

- `statamic/cms < 5.74.3`
- `statamic/cms >= 6.0.0, < 6.24.2`

Patched in:

- `statamic/cms 5.74.3`
- `statamic/cms 6.24.2`

Source: https://github.com/advisories/GHSA-qhr7-v3xp-vw9m