CVE-2023-47129
Statamic CMS remote code execution via front-end form uploads
CRITICAL 9.8EPSS 1.1%
Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded. This only affects forms using the "Forms" feature and not just _any_ arbitrary form. This does not affect the control panel. This issue has been patched in 3.4.13 and 4.33.0.
- Affected
- statamic · cms
- CVSS v3.1 NVD
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v3.1 GITHUB
- 8.3 HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - EPSS
- 1.12% chance of exploitation in the next 30 days, 66th percentile
- Published
- 2023-11-10
- Updated
- 2024-09-03
Proof-of-concept exploits (1)
- Cyber-Wo0dy/CVE-2023-471293★ · 2023-11-13
Security advisories
- statamic/cms/security/advisories/GHSA-72hg-5wr5-rmfc
- advisories/GHSA-72hg-5wr5-rmfc
- statamic/cms/commit/098ef8024d97286ca501273c18ae75b646262d75