GitHub Advisoryadvisory · Packagist

GHSA-m92m-r54r-x8r2 Statamic CMS's unsafe method invocation via collection sorting allows data destruction

HIGH Published 2026-06-26 Modified 2026-06-26 Official page ↗
Aliases
CVE-2026-49287
Ecosystem
Packagist
Packages
statamic/cms
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Weaknesses
CWE-470
Reviewed
2026-06-26

Affected packages

• Packagist statamic/cms: < 5.73.23 → fixed in 5.73.23 • Packagist statamic/cms: >= 6.0.0, < 6.20.0 → fixed in 6.20.0

Description

Impact The fix for GHSA-4jjr-vmv7-wh4w was incomplete. It addressed the issue in the query builder, but the same protection was not applied to in-memory collection sorting. Manipulating sort parameters could result in the loss of content and assets. This requires a front-end template that passes request input into a tag's sort parameter. It is not exploitable by default — a template would need to be explicitly set up to sort by a visitor-controlled value. Patches This has been fixed in 5.73.23 and 6.20.0.

Related

Alias · CVE (1)

  • CVE-2026-49287 Statamic is a Laravel and Git powered content management system (CMS). vulnerability

Weakness · CWE (1)

  • CWE-470 Use of Externally-Controlled Input to Select Classes or Code weakness

References