GHSA-j2vp-f2pv-5rj4: Medium severity composer/statamic/cms vulnerability
Published Aug 6, 2026
·Updated
Impact
Manipulating user-supplied input incorporated into Antlers templates could result in the loss of content and assets.
Exploitation requires a site to have templates that pass untrusted input into affected areas. It does not require authentication.
Patches
This has been fixed in 5.74.1 and 6.24.0.
Affected Software
2 affected componentsFixes available
composer/statamic/cms>=6.0.0<6.24.0
6.24.0
composer/statamic/cms<5.74.1
5.74.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/statamic/cmsto a version that resolves this vulnerability.Fixed in 6.24.0 - Upgrade
Upgrade
composer/statamic/cmsto a version that resolves this vulnerability.Fixed in 5.74.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.74.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.24.0
Event History
Aug 6, 2026
Advisory Published
via GitHub·07:28 PM
Data Sourced
via GitHub·07:28 PM
DescriptionSeverityWeaknessAffected Software