PT-2026-28552 · Statamic · Statamic

Publicado 2026-03-26 · Atualizado 2026-03-28 · CVE-2026-33885

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.73.16 Statamic versions prior to 6.7.2

Description The external URL detection used for redirect validation on unauthenticated endpoints could be bypassed. This allows users to be redirected to external URLs after actions like form submissions and authentication flows.

Recommendations Update to version 5.73.16 or later. Update to version 6.7.2 or later.

Exploit

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2026-33885

GHSA-7F74-7Q5W-HJ4R

Produtos afetados

Statamic

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33885.json · Exploit
• https://github.com/statamic/cms · Nota
• https://github.com/statamic/cms/security/advisories/GHSA-7f74-7q5w-hj4r · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-7f74-7q5w-hj4r · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-33885 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2037719390024786413 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-33885 · Nota de Segurança