Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-33886

Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields

Description

Statamic is a Laravel and Git powered content management system (CMS). Starting in version 5.7.12 and prior to versions 5.73.16 and 6.7.2, a control panel user with access to Antlers-enabled fields could access sensitive application configuration values by inserting config variables into their content. This has been fixed in 5.73.16 and 6.7.2.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

statamic cms

  • >= 5.73.12, < 5.73.16affected
  • >= 6.0.0.alpha.1, < 6.7.2affected

References