AIKIDO-2026-985644
statamic/cms is vulnerable to Unrestricted File Upload
53
Medium Risk
This Affects:
statamic/cmsTL;DR
Public frontend forms do not enforce the file-type upload restrictions that the Control Panel applies. An unauthenticated visitor can submit a form's assets or files field to upload file types an administrator intended to disallow, and for assets fields the file can be stored on a public, web-accessible disk. The global upload allowlist still blocks executable types such as PHP and HTML files, so impact is limited to otherwise-disallowed types. The fix tightens frontend form upload validation so the Control Panel restrictions also apply to public submissions.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your site exposes a public frontend form with an assets or files field.
Background info
statamic/cms is vulnerable to Unrestricted File Upload in versions 0.0.1 - 5.74.2 and 6.0.0 - 6.24.1.
How to fix this
Upgrade the statamic/cms library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant