CVE-2026-25633 json
Statamic's missing authorization allows access to assets
published 2026-02-11 8 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-6201 , GHSA-gwmx-9gcj-332h
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 24%
- public exploits
- 0
- none known
Summary
Statamic is a, Laravel + Git powered CMS designed for building websites. Prior to 5.73.6 and 6.2.5, users without permission to view assets are able are able to download them and view their metadata. Logged-out users and users without permission to access the control panel are unable to take advantage of this. This has been fixed in 5.73.6 and 6.2.5.
Patch / fix
- packagist statamic/cms 5.73.6, 6.2.5
- statamic statamic 5.73.6, 6.2.5
- github.com/statamic/cms@5a6f472 commit
- github.com/statamic/cms#13883 pull request
- github.com/statamic/cms/releases/tag/v5.73.6 release
- github.com/statamic/cms/releases/tag/v6.2.5 release
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 8 mo ago
Exploit prediction
0.32% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | statamic/cms | <5.73.6 >=6.0.0-alpha.1, <6.2.5 |
5.73.6 6.2.5 |
Affected products
- statamic cms
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/statamic/cms/commit/5a6f47246edf3a0c453727ffecbfa14333a6bc8a
web, patch, product
-
github.com
/statamic/cms/pull/13883
web
-
github.com
/statamic/cms/security/advisories/GHSA-gwmx-9gcj-332h
web, vendor-advisory
-
github.com
/statamic/cms/releases/tag/v5.73.6
web, release-notes
-
github.com
/statamic/cms/releases/tag/v6.2.5
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2026-25633
advisory
-
github.com
/statamic/cms
package
Sources
- CVE List CVE-2026-25633
- GitHub Advisory GHSA-gwmx-9gcj-332h
- NVD CVE-2026-25633
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.