CVE-2026-33177: falha de média gravidade em statamic cms
Statamic is missing authorization check on taxonomy term creation via fieldtype
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.3epss 0.2%
Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, low-privileged Control Panel users could create taxonomy terms by submitting requests to the field action processing endpoint with attacker-controlled field definitions. This bypasses the authorization checks enforced on the standard taxonomy term creation endpoint. This has been fixed in 5.73.14 and 6.7.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
statamic · cmsCVEs relacionadas — statamic cms
No mesmo produto, das mais perigosas para as menos.
CVE-2023-47129HIGHStatamic CMS remote code execution via front-end form uploadsEPSS 1.1%CVE-2023-48217HIGHRemote code execution via form uploads in statamic/cmsEPSS 1.1%CVE-2022-24784LOWDiscoverability of user password hash in Statamic CMSEPSS 1.0%CVE-2024-24570HIGHStatamic account takeover via XSS and password reset linkEPSS 0.7%CVE-2023-48701HIGHStatamic CMS vulnerable to Cross-site Scripting via uploaded assetsEPSS 0.7%CVE-2023-36828MEDIUMStatamic's Antlers sanitizer cannot effectively sanitize malicious SVGEPSS 0.7%