GitHub Advisoryadvisory · Packagist

GHSA-72hg-5wr5-rmfc Statamic CMS remote code execution via front-end form uploads

HIGH Published 2023-11-12 Modified 2023-11-12 Official page ↗
Aliases
CVE-2023-47129
Ecosystem
Packagist
Packages
statamic/cms
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-434
Reviewed
2023-11-12

Affected packages

• Packagist statamic/cms: >= 4.0.0, < 4.33.0 → fixed in 4.33.0 • Packagist statamic/cms: < 3.4.13 → fixed in 3.4.13

Description

Impact On front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded regardless of mime validation rules. This only affects forms using the "Forms" feature and not just _any_ arbitrary form. This does not affect the control panel. Patches It has been patched in 3.4.13 and 4.33.0.

Related

Alias · CVE (1)

  • CVE-2023-47129 Statmic is a core Laravel content management system Composer package. vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References