CVE-2026-71435: Statamic CMS Stored Cross-Site Scripting in Automagic Form Notification Email Template
Summary
CVE-2026-71435: Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template. Affects statamic/cms across 2 version ranges.
< 5.74.3
>= 6.0.0, < 6.24.2
Fixed in 5.74.3 or 6.24.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Statamic is a flat-file content management system (CMS) that allows users to build websites without the need for a traditional database. It is known for its flexibility, ease of use, and powerful templating capabilities. However, a vulnerability has been identified in its automagic form notification feature, which can lead to security risks if not addressed.
Vulnerability Detail
The vulnerability arises from the default automagic form notification email functionality, which renders user-submitted values without proper escaping. This allows an unauthenticated user to inject malicious HTML into the notification emails sent to recipients. The potential ramifications include phishing attacks, data theft, and the spread of malware through compromised email communications.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 5.74.35.74.3composer require statamic/cms:5.74.3 -
>= 6.0.0, < 6.24.26.24.2composer require statamic/cms:6.24.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can modify the email template to sanitize user inputs before rendering them in the notification emails. This can be done by using a function that escapes HTML characters, ensuring that any user input is treated as plain text rather than executable HTML.
Conclusion
The CVE-2026-71435 vulnerability in Statamic CMS poses a significant risk due to its stored XSS nature. Users are urged to update to the latest patched versions to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for statamic/cms →
FAQ
The vulnerability is a stored cross-site scripting (XSS) issue that allows attackers to inject malicious HTML into notification emails.
Any user of Statamic CMS who utilizes the automagic form notification feature is potentially affected.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your composer.lock file for vulnerabilities.
The consequences include the potential for phishing attacks, data theft, and the distribution of malware through compromised emails.
Yes, Vulert provides real-time monitoring and alerts for open-source vulnerabilities using just your composer.lock file, without requiring code access.
References
Related vulnerabilities
Recent vulnerabilities recorded for statamic/cms.
