CVE-2026-71434

Summary

Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types

Severity

medium

CVSS

5.3

EPSS

0.4% (p35)

CWE

CWE-434

Also known as

GHSA-qhr7-v3xp-vw9m

Published

2026-08-06

Updated

2026-08-06

Advisory details

Impact

Public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow through a form's assets or files field. For assets fields, files could be stored on a public, web-accessible disk. Statamic's global upload allowlist still applied, so executable types such as .php and .html remained blocked.

Patches

This has been fixed in 5.74.3 and 6.24.2.

References

• https://github.com/advisories/GHSA-qhr7-v3xp-vw9m
• https://github.com/statamic/cms/security/advisories/GHSA-qhr7-v3xp-vw9m
• https://github.com/statamic/cms/pull/14958
• https://github.com/statamic/cms/commit/8be7b6c961536d3173ec4e0965d17b1cf820b7ae
• https://github.com/statamic/cms/releases/tag/v5.74.3
• https://github.com/statamic/cms/releases/tag/v6.24.2

Related advisories

• CVE-2026-27593 — critical · Packagist/statamic/cms
• CVE-2026-64665 — high · Packagist/statamic/cms
• CVE-2026-49287 — high · Packagist/statamic/cms
• CVE-2026-41175 — high · Packagist/statamic/cms
• CVE-2026-33172 — high · Packagist/statamic/cms
• CVE-2026-28426 — high · Packagist/statamic/cms
• CVE-2026-28425 — high · Packagist/statamic/cms
• CVE-2026-27939 — high · Packagist/statamic/cms

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity