CVE-2026-71435

6.1 Moyenne

Publiée le 07/08/2026 à 00:18 · Modifiée le 08/09/2026 à 22:51 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, the default ("automagic") form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the configured recipients. This issue is fixed in versions 5.74.3 and 6.24.2.

Traduire en français

Produits concernés

statamic cms

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.1 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-79

Références

https://github.com/statamic/cms/commit/4ad1335e818a67249d0617f0f167a1198fb96a2c
https://github.com/statamic/cms/pull/14959
https://github.com/statamic/cms/releases/tag/v5.74.3
https://github.com/statamic/cms/releases/tag/v6.24.2
https://github.com/statamic/cms/security/advisories/GHSA-vx89-p3j7-8xqc

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories