CVE-2023-48701 json
Statamic CMS vulnerable to Cross-site Scripting via uploaded assets
published 2023-11-21 2 y ago modified 2026-06-17 4 mo ago also GHSA-8jjh-j3c2-cjcv , EUVD-2023-2924
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 53%
- public exploits
- 0
- none known
Summary
Statamic CMS is a Laravel and Git powered content management system (CMS). Prior to versions 3.4.15 an 4.36.0, HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the "Forms" feature containing an assets field, or within the control panel which requires authentication. This issue has been patched on 3.4.15 and 4.36.0.
Patch / fix
- packagist statamic/cms 3.4.15, 4.36.0
- statamic statamic 3.4.15, 4.36.0
Exploit prediction
0.70% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:H |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | statamic/cms | <3.4.15 >=4.0.0, <4.36.0 |
3.4.15 4.36.0 |
Affected products
- statamic cms
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/statamic/cms/security/advisories/GHSA-8jjh-j3c2-cjcv
web, vendor-advisory
-
github.com
/statamic/cms/releases/tag/v3.4.15
web, release-notes
-
github.com
/statamic/cms/releases/tag/v4.36.0
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2023-48701
advisory
-
github.com
/statamic/cms
package
Sources
- CVE List CVE-2023-48701
- GitHub Advisory GHSA-8jjh-j3c2-cjcv
- NVD CVE-2023-48701
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.