VulnerabilityModified

CVE-2023-48701

Statamic CMS is a Laravel and Git powered content management system (CMS).

MEDIUM 6.1EPSS 0.70%

Does this matter?

Lower severity and a low EPSS score (0.70%). Track it; it rarely justifies an emergency change on its own.

Description

Statamic CMS is a Laravel and Git powered content management system (CMS). Prior to versions 3.4.15 an 4.36.0, HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the "Forms" feature containing an assets field, or within the control panel which requires authentication. This issue has been patched on 3.4.15 and 4.36.0.

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.70% probability · 51th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: statamic/statamic
Source: security-advisories@github.com

References

https://github.com/statamic/cms/releases/tag/v3.4.15Release Notes
https://github.com/statamic/cms/releases/tag/v4.36.0Release Notes
https://github.com/statamic/cms/security/advisories/GHSA-8jjh-j3c2-cjcvVendor Advisory
https://github.com/statamic/cms/releases/tag/v3.4.15Release Notes
https://github.com/statamic/cms/releases/tag/v4.36.0Release Notes
https://github.com/statamic/cms/security/advisories/GHSA-8jjh-j3c2-cjcvVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.