Description

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, the default ("automagic") form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the configured recipients. This issue is fixed in versions 5.74.3 and 6.24.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-06T22:18:30.423Z",
  "pubdate": "2026-08-06T22:18:30.423Z",
  "executiveSummary": "An HTML injection vulnerability exists in Statamic, a Laravel and Git powered content management system (CMS). The vulnerability specifically resides in the default automagic form notification email functionality prior to versions 5.74.3 and 6.24.2. This security flaw allows an unauthenticated remote attacker to submit specially crafted input containing arbitrary HTML tags through public-facing form submissions. When the CMS processes and dispatches the notification email to configured recipients, the user-supplied values are rendered without proper sanitization or context-aware output encoding. The primary impact of this vulnerability involves the potential manipulation of email content, leading to social engineering attacks, phishing, or visual defacement of notification messages received by administrative users. Exploitation requires no prior authentication, specific privileges, or user interaction beyond the attacker interacting with a functional form endpoint exposed by the target application. Risk implications include compromised communication integrity between the CMS and its administrators. Remediation requires upgrading the Statamic application to versions 5.74.3, 6.24.2, or subsequent patched releases where input escaping for form notification emails is correctly enforced.",
  "technicalDetails": "The vulnerability is rooted in the insecure handling and rendering of user-submitted data within the default form notification email generation routine of Statamic. Specifically, the component responsible for building the automagic notification emails fails to apply appropriate HTML escaping or sanitization functions to parameters derived directly from incoming HTTP POST requests submitted via frontend forms. Consequently, any string data provided by an unauthenticated user inside form fields is treated as trusted markup when the template compiles the outbound email body for recipients.\nThe attack flow proceeds as follows: First, an unauthenticated attacker identifies a publicly accessible form managed by the Statamic CMS. Second, the attacker crafts an HTTP request targeting the form submission endpoint, embedding arbitrary HTML tags or structured markup within standard or custom form fields. Third, the Statamic application ingests the payload without validation or output encoding filters. Fourth, the CMS automatically generates a notification email incorporating the unsubmitted raw parameters into the message body. Finally, when the configured recipient opens the notification email in an HTML-compatible mail user agent (MUA), the injected markup is rendered, altering the visual structure or executing semantic modifications within the message context.\nThe affected components are Statamic versions prior to 5.74.3 in the 5.x branch and prior to 6.24.2 in the 6.x branch. The authentication requirement is completely absent, allowing unauthenticated threat actors over the network to trigger the vulnerability. No elevated privileges are required, and exploitation complexity remains low due to the automated processing of form inputs into notification templates. Post-exploitation impact is constrained primarily to the context of the rendered email, but successful injection can facilitate downstream social engineering vectors against administrative personnel."
}