PT-2026-26065 · Statamic · Statamic

Spbavarva · Publicado 2026-03-18 · Atualizado 2026-03-21 · CVE-2026-33171

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.73.14 Statamic versions prior to 6.7.0

Description Statamic is a Laravel and Git powered content management system (CMS). Authenticated Control Panel users could read arbitrary .json, .yaml, and .csv files from the server by manipulating the filename configuration parameter in the file dictionary's fieldtype endpoint. The issue occurs through the manipulation of the filename parameter within the API endpoint used by the file dictionary fieldtype.

Recommendations Update to Statamic version 5.73.14 or later. Update to Statamic version 6.7.0 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-33171

GHSA-QM7R-WWQ7-6F85

Produtos afetados

Statamic

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33171.json · Exploit
• https://github.com/statamic/cms · Nota
• https://github.com/statamic/cms/security/advisories/GHSA-qm7r-wwq7-6f85 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-33171 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33171 · Nota de Segurança
• https://twitter.com/CVEnew/status/2035262147035353583 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-qm7r-wwq7-6f85 · Aviso do Fabricante
• https://twitter.com/BavarvaSneh/status/2034076909768781887 · Publicação no Twitter