Vulnerability record · CVE-2023-47129 · published 10 November 2023

CVE-2023-47129: Statamic unrestricted file upload vulnerability

Statamic · Statamic

Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded. This only affects forms using the "Forms" feature and not just _any_ arbitrary form. This does not affect the control panel. This issue has been patched in 3.4.13 and 4.33.0.

9.8 CVSS 3.1 Critical EPSS 1.1% · top 35.2% CWE-434 · Unrestricted file upload

9.8CVSS 3.1 base score

1.1%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Statamic Statamic

References

Link	Tags
https://github.com/statamic/cms/commit/098ef8024d97286ca501273c18ae75b646262d75	Patch
https://github.com/statamic/cms/commit/f6c688154f6bdbd0b67039f8f11dcd98ba061e77	Patch
https://github.com/statamic/cms/security/advisories/GHSA-72hg-5wr5-rmfc	Vendor Advisory
https://github.com/statamic/cms/commit/098ef8024d97286ca501273c18ae75b646262d75	Patch
https://github.com/statamic/cms/commit/f6c688154f6bdbd0b67039f8f11dcd98ba061e77	Patch
https://github.com/statamic/cms/security/advisories/GHSA-72hg-5wr5-rmfc	Vendor Advisory

Track CVE-2023-47129 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-45364Statamic vulnerabilityA Code Execution vulnerability exists in Statamic Version through 3.2.26 via SettingsController.php. NOTE: the vendor indicates that there was an err…EPSS 1.7%10 Feb 2022 8.8CVE-2026-27939Statamic improper authentication vulnerabilityStatmatic is a Laravel and Git powered content management system (CMS). Starting in version 6.0.0 and prior to version 6.4.0, Authenticated Control P…EPSS 0.46%27 Feb 2026 8.8CVE-2026-27593Statamic weak password recovery vulnerabilityStatmatic is a Laravel and Git powered content management system (CMS). Prior to versions 6.3.3 and 5.73.10, an attacker may leverage a vulnerability…EPSS 0.55%24 Feb 2026 8.8CVE-2023-48217Statamic code injection vulnerabilityStatamic is a flat-first, Laravel + Git powered CMS designed for building websites. In affected versions certain additional PHP files crafted to look…EPSS 1.1%14 Nov 2023 8.8CVE-2017-11422Statamic incorrect permission assignment vulnerabilityStatamic framework before 2.6.0 does not correctly check a session's permissions when the methods from a user's class are called. Problematic methods…EPSS 0.87%24 Jul 2017 8.7CVE-2026-33172Statamic cross-site scripting vulnerabilityStatamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, a stored XSS vulnerability in SVG asset r…EPSS 0.36%20 Mar 2026 8.7CVE-2026-25759Statamic cross-site scripting vulnerabilityStatmatic is a Laravel and Git powered content management system (CMS). From 6.0.0 to before 6.2.3, a stored XSS vulnerability in content titles allo…EPSS 0.44%11 Feb 2026 8.6CVE-2026-28423Statamic server-side request forgery (ssrf) vulnerabilityStatmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, when Glide image manipulation is used in…EPSS 0.47%27 Feb 2026

Source: NIST National Vulnerability Database (record CVE-2023-47129), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.