PT-2026-28553 · Statamic · Statamic

Published 2026-03-26 · Updated 2026-03-28 · CVE-2026-33886

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Statamic versions 5.7.12 through 5.73.15 Statamic versions 6.7.0 through 6.7.1

Description A control panel user with access to Antlers-enabled fields could access sensitive application configuration values by inserting config variables into their content. The issue involves the ability to access application configuration values through the insertion of config variables within content managed via Antlers-enabled fields.

Recommendations Update to Statamic version 5.73.16 or later. Update to Statamic version 6.7.2 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-33886

GHSA-GCQF-5X9F-HQ7F

Affected Products

Statamic

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33886.json · Exploit
• https://github.com/statamic/cms/security/advisories/GHSA-gcqf-5x9f-hq7f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33886 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33886 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gcqf-5x9f-hq7f · Vendor Advisory
• https://github.com/statamic/cms · Note
• https://twitter.com/CVEnew/status/2037719388904976715 · Twitter Post