CyberRota Analysis
AI-GeneratedStatamic CMS versions prior to 5.74.3 and 6.24.2 are vulnerable due to insufficient enforcement of file upload restrictions on public frontend forms, allowing unauthenticated users to upload disallowed file types. This could lead to potential exposure of sensitive data or unauthorized access if malicious files are uploaded. Organizations using affected versions should prioritize updating to the latest releases to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow through a form's assets or files field, and for assets fields, files could be stored on a public, web-accessible disk, though the application's global upload allowlist still blocked executable types such as .php and .html. This issue is fixed in versions 5.74.3 and 6.24.2.