GHSA-72hg-5wr5-rmfcHighCVSS 8.3

Statamic CMS remote code execution via front-end form uploads

Published
November 12, 2023
Last Modified
November 12, 2023

🔗 CVE IDs covered (1)

CVE-2023-47129 →

📋 Description

Impact

On front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded regardless of mime validation rules. This only affects forms using the "Forms" feature and not just any arbitrary form. This does not affect the control panel.

Patches

It has been patched in 3.4.13 and 4.33.0.

🎯 Affected products2

  • composer/statamic/cms:>= 4.0.0, < 4.33.0
  • composer/statamic/cms:< 3.4.13

🔗 References (5)