Description

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow through a form's assets or files field, and for assets fields, files could be stored on a public, web-accessible disk, though the application's global upload allowlist still blocked executable types such as .php and .html. This issue is fixed in versions 5.74.3 and 6.24.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-06T22:18:30.260Z",
  "pubdate": "2026-08-06T22:18:30.260Z",
  "executiveSummary": "Statamic prior to versions 5.74.3 and 6.24.2 suffers from an insufficient validation vulnerability within public frontend forms.\nThe vulnerability allows unauthenticated remote visitors to bypass administrative file upload restrictions defined for assets and files fields.\nImpact includes the unauthorized storage of disallowed file types on public, web-accessible storage disks, though the global application upload allowlist continues to block executable payloads such as .php and .html files.\nRisk implications center around potential resource exhaustion, unauthorized data storage, and the accumulation of unvetted file types within web-accessible directories.\nAttacker capabilities require network access to submit public frontend forms capable of accepting file uploads.\nNo authentication or elevated privileges are required to exploit this validation gap.",
  "technicalDetails": "The root cause of the vulnerability lies in a divergence of security controls between the Statamic Control Panel and public frontend form submission handlers.\nWhile the Control Panel rigorously enforces administrative file upload restrictions regarding asset and file fields, the public frontend form handling logic fails to enforce these identical constraints.\nThe vulnerable component involves the form processing and validation subsystems responsible for handling asset and file field inputs submitted via public frontend interfaces.\nAffected products include Statamic versions prior to 5.74.3 and versions prior to 6.24.2.\nAuthentication and privilege requirements are entirely absent, permitting unauthenticated visitors across the network to interact with exposed frontend forms.\nThe step-by-step attack flow begins when an unauthenticated actor identifies a public frontend form containing an assets or files field.\nThe attacker crafts an HTTP multipart/form-data request containing a file type that an administrator explicitly intended to disallow via the field configuration.\nUpon submission, the vulnerable backend handler processes the request without validating against the field-specific restrictions.\nThe payload is subsequently stored on a public, web-accessible disk associated with the application.\nDespite the bypass of field-level configurations, the application's global upload allowlist remains active, successfully preventing the execution or storage of dangerous executable file types such as .php and .html.\nPost-exploitation impact is constrained by the global allowlist, but still permits the unauthorized population of public storage directories with restricted file formats."
}