PT-2026-28549 · Statamic · Statamic

Published 2026-03-26 · Updated 2026-04-08 · CVE-2026-33882

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.73.16 Statamic versions prior to 6.7.2

Description The markdown preview endpoint in Statamic could be manipulated to retrieve augmented data from arbitrary fieldtypes. Specifically, an authenticated control panel user could access sensitive user data, including email addresses, encrypted passkey data, and encrypted two-factor authentication codes, through the users fieldtype. The /preview API endpoint is affected. The vulnerable parameter is the fieldtype used in the markdown preview.

Recommendations Update to Statamic version 5.73.16 or later. Update to Statamic version 6.7.2 or later.

Exploit

Fix

RCE

Information Disclosure

Weakness Enumeration

CWE-20

CWE-200

Related Identifiers

CVE-2026-33882

GHSA-CVH3-23VQ-W7H4

Affected Products

Statamic

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33882.json · Exploit
• https://github.com/statamic/cms/security/advisories/GHSA-cvh3-23vq-w7h4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33882 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33882 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cvh3-23vq-w7h4 · Vendor Advisory
• https://github.com/statamic/cms · Note
• https://twitter.com/CVEnew/status/2037719393510310063 · Twitter Post
• https://t.me/cveNotify/158454 · Telegram Post