VulertSecurity VulertSecurity

Vulnerability Database · Packagist · statamic/cms · Version

statamic/cms v6.3.2

v6.3.2 is affected by 37 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to.

Critical 1 High 10 Medium 24 Low 2 Unrated 0

All statamic/cms versions & vulnerabilities → Search the database for this package →
Database updated 23/Oct/2026

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

statamic/cms v6.3.2 vulnerabilities

37 vulnerabilities cover statamic/cms v6.3.2. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2026-27593: Statamic CMS Account Takeover via Password Reset Link Injection 9.3 critical 5.73.10 24 Feb 2026
CVE-2026-27939: Statamic CMS Privilege Escalation via Elevated Session Bypass 8.8 high 6.4.0 27 Feb 2026
CVE-2017-11422: Statamic framework Incorrect Permission Assignment 8.8 high 2.6.0 13 May 2022
CVE-2026-33172: Statamic CMS Stored XSS via SVG Sanitization Bypass 8.7 high 6.7.0 18 Mar 2026
CVE-2026-28426: Statamic CMS Privilege Escalation via Stored XSS 8.7 high 5.73.11 01 Mar 2026
CVE-2026-64665: Statamic Account Takeover via OAuth Email Matching Vulnerability 8.1 high 5.74.1 06 Aug 2026
Data Destruction Risk in Statamic CMS: Unsafe Method Invocation Vulnerability 8.1 high 5.73.20 16 Apr 2026
CVE-2026-28425: Statamic CMS Remote Code Execution Vulnerability 8.0 high 5.73.11 01 Mar 2026
CVE-2025-64112: Statamic CMS Vulnerable to Superadmin Account Takeover via Stored XSS 8.0 high 5.22.1 30 Oct 2025
Cross-site Scripting via uploaded assets in statamic/cms 7.5 high 3.4.15 22 Nov 2023
CVE-2026-49287: Statamic CMS Collection Sorting Vulnerability Leading to Data Loss 7.4 high 5.73.23 26 Jun 2026
CVE-2026-28423: Statamic CMS Vulnerable to Server-Side Request Forgery via Glide 6.8 medium 5.73.11 01 Mar 2026
CVE-2026-64662: Statamic CMS Missing Authorization on Navigation Endpoint 6.5 medium 5.74.1 06 Aug 2026
CVE-2026-64663: Statamic CMS Unsafe Method Invocation via Antlers Template Resolution 6.5 medium 5.74.1 06 Aug 2026
CVE-2026-33882: Statamic CMS Markdown Preview Endpoint Exposes Sensitive User Data 6.5 medium 5.73.16 26 Mar 2026
CVE-2026-28424: Statamic CMS Missing Authorization Exposes User Email Addresses 6.5 medium 5.73.11 01 Mar 2026
CVE-2026-71293: Statamic CMS Exposes Two-Factor Recovery Codes Through Dynamic Antlers Rendering 6.2 medium No fix published 05 Aug 2026
CVE-2026-71435: Statamic CMS Stored Cross-Site Scripting in Automagic Form Notification Email Template 6.1 medium 5.74.3 06 Aug 2026
CVE-2026-54243: Statamic CSV Formula Injection Vulnerability 6.1 medium 6.20.1 26 Jun 2026
CVE-2026-33885: Statamic CMS Open Redirect Vulnerability on Unauthenticated Endpoints 6.1 medium 5.73.16 26 Mar 2026
CVE-2026-33883: Statamic CMS Reflected XSS Vulnerability in Password Reset Form 6.1 medium 5.73.16 26 Mar 2026
CVE-2023-36828: Statamic CMS - Ineffective Sanitization of SVG Tag 5.5 medium 4.10.0 06 Jul 2023
CVE-2026-45660: Statamic CMS Server-Side Request Forgery via Glide 5.4 medium 5.73.22 18 May 2026
CVE-2026-33887: Statamic CMS Unauthorized Content Access via Revision Controllers 5.4 medium 5.73.16 26 Mar 2026
CVE-2026-32612: Statamic CMS Privilege Escalation via Stored XSS 5.4 medium 6.6.2 13 Mar 2026
CVE-2026-71434: Statamic CMS Missing File Upload Validation Vulnerability 5.3 medium 5.74.3 06 Aug 2026
CVE-2026-44306: Statamic CMS Email Enumeration Vulnerability in Forgot Password Endpoint 5.3 medium 5.73.21 06 May 2026
CVE-2024-52600: Statamic CMS Path Traversal Vulnerability in Asset Upload 5.3 medium 5.17.0 19 Nov 2024
CVE-2026-54242: Statamic CMS Vulnerable to Server-Side Request Forgery via Glide (DNS Rebinding) 4.9 medium 5.73.24 26 Jun 2026
CVE-2026-64664: Statamic CMS User Existence Disclosure Vulnerability 4.3 medium 5.74.1 06 Aug 2026
CVE-2026-49288: Statamic CMS Missing Authorization Vulnerability 4.3 medium 5.73.23 26 Jun 2026
CVE-2026-33884: Statamic CMS Live Preview Token Bypass Vulnerability 4.3 medium 5.73.16 26 Mar 2026
CVE-2026-33177: Statamic CMS Authorization Bypass in Taxonomy Term Creation 4.3 medium 6.7.0 18 Mar 2026
CVE-2026-33171: Statamic CMS Path Traversal Vulnerability in File Dictionary Fieldtype 4.3 medium 6.7.0 18 Mar 2026
CVE-2026-25633: Statamic CMS Missing Authorization Vulnerability Allows Unauthorized Access to Assets 4.3 medium 5.73.6 11 Feb 2026
CVE-2022-24784: Discoverability of user password hash in Statamic CMS 3.7 low 3.2.39 29 Mar 2022
CVE-2026-54244: Statamic CMS Authorization Flaw Allows View-Only Users to Submit Live Preview Content 3.5 low 5.74.0 26 Jun 2026

Looking for another version, or everything Vulert holds for statamic/cms?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About statamic/cms v6.3.2

Is statamic/cms v6.3.2 vulnerable?

Yes. 37 vulnerabilities in the Vulert database cover statamic/cms v6.3.2: 1 critical, 10 high, 24 medium and 2 low. Each entry above names the fixed version to move to.

How do I monitor statamic/cms for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the statamic/cms version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.