CVE-2026-71434: Statamic CMS Missing File Upload Validation Vulnerability
Summary
CVE-2026-71434: Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types. Affects statamic/cms across 2 version ranges.
< 5.74.3
>= 6.0.0, < 6.24.2
Fixed in 5.74.3 or 6.24.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Statamic is a flat-file content management system (CMS) that allows users to create and manage websites without the need for a traditional database. It is known for its flexibility, ease of use, and powerful features such as version control, asset management, and a user-friendly control panel. However, a recent vulnerability has been identified that affects the file upload functionality in public frontend forms, potentially allowing unauthorized file types to be uploaded.
Vulnerability Detail
The vulnerability arises from the lack of enforcement of file upload restrictions on public frontend forms, which are intended to prevent the uploading of disallowed file types. An unauthenticated visitor could exploit this weakness to upload files that an administrator had intended to block, particularly through the 'assets' or 'files' fields. Although Statamic's global upload allowlist still prevents certain executable file types like .php and .html from being uploaded, the absence of validation on frontend forms poses a significant security risk, as it could lead to unauthorized access or execution of malicious files.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 5.74.35.74.3composer require statamic/cms:5.74.3 -
>= 6.0.0, < 6.24.26.24.2composer require statamic/cms:6.24.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can restrict access to the public frontend forms that allow file uploads until the package is updated. This can be done by removing or disabling the forms in question or implementing additional server-side validation to check file types before processing uploads.
Conclusion
The CVE-2026-71434 vulnerability in Statamic CMS highlights the importance of enforcing file upload restrictions on public forms. By updating to the latest patched versions, users can mitigate the risks associated with this vulnerability and ensure the security of their applications.
See every vulnerability recorded for statamic/cms →
FAQ
CVE-2026-71434 is a vulnerability in Statamic CMS that allows unauthorized file types to be uploaded through public frontend forms due to missing file upload validation.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner for a quick assessment without needing to sign up.
The risks include the potential for unauthorized file uploads, which could lead to the execution of malicious files, data breaches, or other security incidents.
You can update your Statamic CMS package using Composer. Run the command 'composer update statamic/cms' to upgrade to the patched version.
If you cannot update immediately, consider restricting access to the affected frontend forms or implementing additional server-side validation as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for statamic/cms.
