Description

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, manipulating user-supplied input incorporated into Antlers templates could result in the loss of content and assets, on sites whose templates pass untrusted input into affected areas, and exploitation did not require authentication. This issue is fixed in versions 5.74.1 and 6.24.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-06T22:18:13.820Z",
  "pubdate": "2026-08-06T22:18:13.820Z",
  "executiveSummary": "A vulnerability exists in Statamic, a Laravel and Git-powered content management system, that allows unauthenticated threat actors to cause the loss of critical site content and assets. The vulnerability stems from the improper handling and manipulation of user-supplied input that is dynamically incorporated into Antlers templates. When affected sites process untrusted input within vulnerable template areas, improper sanitization or validation leads to unintended destructive operations performed by the CMS. This flaw poses a severe risk to data integrity, as successful exploitation results in the permanent deletion or corruption of stored content and assets residing within the repository or database-backed structures. Exploitation of this security defect requires zero authentication, lowering the attack barrier for remote malicious actors targeting exposed instances of the content management system. The vulnerability affects all versions of Statamic prior to 5.74.1 in the 5.x branch and prior to 6.24.0 in the 6.x branch. Organizations utilizing the platform must prioritize immediate patching to the aforementioned fixed versions to eliminate the risk of data destruction and maintain operational continuity across their web properties.",
  "technicalDetails": "The vulnerability resides within the template rendering engine of Statamic, specifically concerning the processing of Antlers templates when rendering user-supplied input. The root cause is the lack of strict input sanitization and validation prior to evaluating and executing logic derived from untrusted parameters passed into vulnerable areas of the template architecture. Statamic utilizes a robust templating system designed to parse dynamic tags and expressions; however, when external input is insufficiently restricted, an attacker can manipulate this input to inject malicious directives or payload structures that interact with the underlying content management operations. The vulnerable component involves the template parsing pipeline where dynamic attributes intersect with file system or data store mutations. The attack flow begins when an unauthenticated remote attacker identifies an endpoint or form submission mechanism that reflects or processes user-supplied input directly into an affected Antlers template. The attacker crafts a specialized payload designed to abuse template evaluation mechanics, forcing the application to execute destructive file operations or asset manipulation routines. Because the application executes these routines based on the manipulated template logic, critical content and associated assets are systematically deleted, overwritten, or otherwise rendered unrecoverable. The technical impact involves absolute data destruction, manifesting as the loss of pages, entries, files, and media assets managed by the Git-backed or Laravel-driven backend. Network exposure is universal for any web application running an unpatched version of Statamic with public-facing routes that pass dynamic parameters into Antlers templates. The vulnerability requires no prior authentication, zero elevated privileges, and relies entirely on the application's inherent handling of untrusted template variables. Mitigation requires upgrading the Statamic core to version 5.74.1 or version 6.24.0, where the underlying input handling and template parsing logic have been patched to safely reject or neutralize malicious input constructs."
}