Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.0
Statamic Control Panel Allows Remote Code Execution
CVE-2026-28425
GHSA-cpv7-q2wx-m8rw
Summary
An attacker with control panel access can execute malicious code on your website, potentially leading to data theft, system crashes, or complete control of your application. This can happen if you have Statamic's Antlers enabled in certain areas, such as custom content fields or email notification settings. Update to Statamic version 5.73.11 or 6.4.0 to fix this issue.
What to do
- Update statamic cms to version 5.73.11.
- Update statamic cms to version 6.4.0.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| statamic | cms | <= 5.73.11 | 5.73.11 |
| statamic | cms | > 6.0.0-alpha.1 , <= 6.4.0 | 6.4.0 |
| statamic | statamic | <= 5.73.11 | – |
| statamic | statamic | > 6.0.0 , <= 6.4.0 | – |
Original title
Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs
Original description
### Impact
An authenticated control panel user with access to Antlers-enabled inputs may be able to achieve remote code execution in the application context. That can lead to full compromise of the application, including access to sensitive configuration, modification or exfiltration of data, and potential impact on availability.
Exploitation is only possible where Antlers runs on user-controlled content—for example, content fields with Antlers explicitly enabled (requiring permission to configure fields and to edit entries), built-in config that supports Antlers such as Forms email notification settings (requiring configuration permission), or third-party addons that add Antlers-enabled fields to entries (for example, the SEO Pro addon). In each case the attacker must have the relevant control panel permissions.
### Patches
This has been fixed in 5.73.11 and 6.4.0. If developers use addons that depend on Statamic, ensure that a patched version of Statamic is running.
An authenticated control panel user with access to Antlers-enabled inputs may be able to achieve remote code execution in the application context. That can lead to full compromise of the application, including access to sensitive configuration, modification or exfiltration of data, and potential impact on availability.
Exploitation is only possible where Antlers runs on user-controlled content—for example, content fields with Antlers explicitly enabled (requiring permission to configure fields and to edit entries), built-in config that supports Antlers such as Forms email notification settings (requiring configuration permission), or third-party addons that add Antlers-enabled fields to entries (for example, the SEO Pro addon). In each case the attacker must have the relevant control panel permissions.
### Patches
This has been fixed in 5.73.11 and 6.4.0. If developers use addons that depend on Statamic, ensure that a patched version of Statamic is running.
nvd CVSS3.1
8.0
Vulnerability type
CWE-94
Code Injection
- https://nvd.nist.gov/vuln/detail/CVE-2026-28425
- https://github.com/advisories/GHSA-cpv7-q2wx-m8rw
- https://github.com/statamic/cms/releases/tag/v5.73.11 Release Notes
- https://github.com/statamic/cms/releases/tag/v6.4.0 Release Notes
- https://github.com/statamic/cms/security/advisories/GHSA-cpv7-q2wx-m8rw Patch Vendor Advisory
Published: 1 Mar 2026 · Updated: 13 Mar 2026 · First seen: 6 Mar 2026