Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded. This only affects forms using the "Forms" feature and not just _any_ arbitrary form. This does not affect the control panel. This issue has been patched in 3.4.13 and 4.33.0.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| statamic | cms | affected |
|
Configuration 1 [-]
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2023-2902 | Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded. This only affects forms using the "Forms" feature and not just _any_ arbitrary form. This does not affect the control panel. This issue has been patched in 3.4.13 and 4.33.0. |
 Github GHSA |
GHSA-72hg-5wr5-rmfc | Statamic CMS remote code execution via front-end form uploads |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
No history.
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2024-09-03T17:24:55.886Z
Reserved: 2023-10-30T19:57:51.677Z
Link: CVE-2023-47129
Vulnrichment
Updated: 2024-08-02T21:01:22.814Z
NVD
Status : Modified
Published: 2023-11-10T19:15:16.617
Modified: 2024-11-21T08:29:50.363
Link: CVE-2023-47129
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses