What’s Vulnerable › Vulnerabilities

CVE-2026-71435: Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-06 · updated 2026-10-24
• Weakness: CWE-79

Description

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, the default ("automagic") form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the configured recipients. This issue is fixed in versions 5.74.3 and 6.24.2.

Affected products

• statamic cms: before 5.74.3; from 6.0.0, < 6.24.2

References

• https://github.com/statamic/cms/commit/4ad1335e818a67249d0617f0f167a1198fb96a2c
• https://github.com/statamic/cms/pull/14959
• https://github.com/statamic/cms/releases/tag/v5.74.3
• https://github.com/statamic/cms/releases/tag/v6.24.2
• https://github.com/statamic/cms/security/advisories/GHSA-vx89-p3j7-8xqc

Get alerted when CVE-2026-71435 or the next vulnerability affects your stack