PT-2026-28549 · Statamic · Statamic

Publicado 2026-03-26 · Atualizado 2026-04-08 · CVE-2026-33882

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.73.16 Statamic versions prior to 6.7.2

Description The markdown preview endpoint in Statamic could be manipulated to retrieve augmented data from arbitrary fieldtypes. Specifically, an authenticated control panel user could access sensitive user data, including email addresses, encrypted passkey data, and encrypted two-factor authentication codes, through the users fieldtype. The /preview API endpoint is affected. The vulnerable parameter is the fieldtype used in the markdown preview.

Recommendations Update to Statamic version 5.73.16 or later. Update to Statamic version 6.7.2 or later.

Exploit

Correção

RCE

Information Disclosure

Enumeração de Fraquezas

CWE-20

CWE-200

Identificadores relacionados

CVE-2026-33882

GHSA-CVH3-23VQ-W7H4

Produtos afetados

Statamic

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33882.json · Exploit
• https://github.com/statamic/cms · Nota
• https://github.com/statamic/cms/security/advisories/GHSA-cvh3-23vq-w7h4 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33882 · Nota de Segurança
• https://twitter.com/CVEnew/status/2037719393510310063 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-33882 · Aviso do Fabricante
• https://t.me/cveNotify/158454 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-cvh3-23vq-w7h4 · Aviso do Fabricante