GHSA-2r53-9295-3m86HighCVSS 8.8

Statamic CMS vulnerable to remote code execution via form uploads

Published
November 14, 2023
Last Modified
November 22, 2023

🔗 CVE IDs covered (1)

CVE-2023-48217 →

📋 Description

Impact

Similar to another advisory, certain additional PHP files crafted to look like images may be uploaded regardless of mime type validation rules. This affects front-end forms using the "Forms" feature, and asset upload fields in the control panel.

Patches

It has been patched in 3.4.14 and 4.34.0.

🎯 Affected products2

  • composer/statamic/cms:>= 4.0.0, < 4.34.0
  • composer/statamic/cms:< 3.4.14

🔗 References (9)