VULNERABILITY INTELLIGENCE

CVE-2026-71435

CVSS score6.1 MEDIUM
EPSS probability0.34%
CISA KEVNot currently listed
Published2026-08-06
Last modified2026-10-24
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, the default ("automagic") form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the configured recipients. This issue is fixed in versions 5.74.3 and 6.24.2.

Weakness classification

  • security-advisories@github.com: CWE-79

Primary references