PT-2026-28552 · Statamic · Statamic

Published 2026-03-26 · Updated 2026-03-28 · CVE-2026-33885

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.73.16 Statamic versions prior to 6.7.2

Description The external URL detection used for redirect validation on unauthenticated endpoints could be bypassed. This allows users to be redirected to external URLs after actions like form submissions and authentication flows.

Recommendations Update to version 5.73.16 or later. Update to version 6.7.2 or later.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-33885

GHSA-7F74-7Q5W-HJ4R

Affected Products

Statamic

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33885.json · Exploit
• https://github.com/statamic/cms/security/advisories/GHSA-7f74-7q5w-hj4r · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7f74-7q5w-hj4r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33885 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33885 · Security Note
• https://github.com/statamic/cms · Note
• https://twitter.com/CVEnew/status/2037719390024786413 · Twitter Post