GitHub Advisoryadvisory · Packagist

GHSA-vx89-p3j7-8xqc Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template

MEDIUM Published 2026-08-06 Modified 2026-08-06 Official page ↗
Aliases
CVE-2026-71435
Ecosystem
Packagist
Packages
statamic/cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2026-08-06

Affected packages

• Packagist statamic/cms: < 5.74.3 → fixed in 5.74.3 • Packagist statamic/cms: >= 6.0.0, < 6.24.2 → fixed in 6.24.2

Description

Impact The default ("automagic") form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the configured recipients Patches This has been fixed in 5.74.3 and 6.24.2.

Related

Alias · CVE (1)

  • CVE-2026-71435 Statamic is a Laravel and Git powered content management system (CMS). vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References