PT-2026-22422 · Statmatic · Statmatic

Dxleryt · Published 2026-02-27 · Updated 2026-03-05 · CVE-2026-28423

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Statmatic versions prior to 5.73.11 Statmatic versions prior to 6.4.0

Description Statmatic is a content management system. When Glide image manipulation is used in insecure mode, an unauthenticated user can exploit the image proxy to make the server send HTTP requests to arbitrary URLs. This can potentially allow access to internal services and cloud metadata endpoints reachable from the server.

Recommendations Update to version 5.73.11 or later. Update to version 6.4.0 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-28423

GHSA-CWPP-325Q-2CVP

Affected Products

Statmatic

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28423.json · Exploit
• https://github.com/statamic/cms/security/advisories/GHSA-cwpp-325q-2cvp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28423 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28423 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cwpp-325q-2cvp · Vendor Advisory
• https://github.com/statamic/cms · Note
• https://github.com/statamic/cms/releases/tag/v5.73.11 · Note
• https://github.com/statamic/cms/releases/tag/v6.4.0 · Note
• https://twitter.com/VulmonFeeds/status/2027548938291601418 · Twitter Post
• https://t.me/cveNotify/154330 · Telegram Post
• https://t.me/CVEtracker/46012 · Telegram Post
• https://twitter.com/CVEnew/status/2027744212721058259 · Twitter Post