GitHub Advisoryadvisory · Packagist

GHSA-j2vp-f2pv-5rj4 Statamic: Unsafe method invocation via Antlers template resolution allows data destruction

MEDIUM Published 2026-08-06 Modified 2026-08-06 Official page ↗
Aliases
CVE-2026-64663
Ecosystem
Packagist
Packages
statamic/cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Weaknesses
CWE-470
Reviewed
2026-08-06

Affected packages

• Packagist statamic/cms: < 5.74.1 → fixed in 5.74.1 • Packagist statamic/cms: >= 6.0.0, < 6.24.0 → fixed in 6.24.0

Description

Impact Manipulating user-supplied input incorporated into Antlers templates could result in the loss of content and assets. Exploitation requires a site to have templates that pass untrusted input into affected areas. It does not require authentication. Patches This has been fixed in 5.74.1 and 6.24.0.

Related

Alias · CVE (1)

  • CVE-2026-64663 Statamic is a Laravel and Git powered content management system (CMS). vulnerability

Weakness · CWE (1)

  • CWE-470 Use of Externally-Controlled Input to Select Classes or Code weakness

References