Is statamic/cms affected by CVE-2026-64663?

Packagist statamic/cms is affected in = 6.0.0 < 6.24.0.

Is CVE-2026-64663 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.4%.

medium

CVE-2026-64663

Q: Is CVE-2026-64663 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.4%.

Packagist · statamic/cms

Summary

Statamic: Unsafe method invocation via Antlers template resolution allows data destruction

Severity: medium
CVSS: 6.5
EPSS: 0.4% (p33)
CWE: CWE-470
Also known as: GHSA-j2vp-f2pv-5rj4
Published: 2026-08-06
Updated: 2026-08-06

Advisory details

Impact

Manipulating user-supplied input incorporated into Antlers templates could result in the loss of content and assets.

Exploitation requires a site to have templates that pass untrusted input into affected areas. It does not require authentication.

Patches

This has been fixed in 5.74.1 and 6.24.0.

References

Related advisories

CVE-2026-49287 — high · Packagist/statamic/cms
CVE-2026-27593 — critical · Packagist/statamic/cms
CVE-2026-64665 — high · Packagist/statamic/cms
CVE-2026-41175 — high · Packagist/statamic/cms
CVE-2026-33172 — high · Packagist/statamic/cms
CVE-2026-28426 — high · Packagist/statamic/cms
CVE-2026-28425 — high · Packagist/statamic/cms
CVE-2026-27939 — high · Packagist/statamic/cms

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.