CVE-2026-33171: Statamic has a path traversal in file dictionary fieldtype
Impact
Authenticated Control Panel users could read arbitrary .json, .yaml, and .csv files from the server by manipulating the file dictionary's filename configuration parameter in the fieldtype's endpoint.
Patches
This has been fixed in 5.73.14 and 6.7.0.
Other sources
Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, authenticated Control Panel users could read arbitrary .json, .yaml, and .csv files from the server by manipulating the file dictionary's filename configuration parameter in the fieldtype's endpoint. This has been fixed in 5.73.14 and 6.7.0.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33171?
CVE-2026-33171 is rated as a medium severity vulnerability due to its potential for unauthorized file access by authenticated users.
How do I fix CVE-2026-33171?
To fix CVE-2026-33171, upgrade to Statamic version 5.73.14 or version 6.7.0.
Who is affected by CVE-2026-33171?
CVE-2026-33171 affects authenticated Control Panel users of Statamic who can exploit the file dictionary fieldtype.
What types of files can be accessed due to CVE-2026-33171?
Due to CVE-2026-33171, attackers can read `.json`, `.yaml`, and `.csv` files from the server.
What is the nature of the vulnerability in CVE-2026-33171?
CVE-2026-33171 is a path traversal vulnerability that allows unauthorized file access.