Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, authenticated Control Panel users could read arbitrary `.json`, `.yaml`, and `.csv` files from the server by manipulating the file dictionary's `filename` configuration parameter in the fieldtype's endpoint. This has been fixed in 5.73.14 and 6.7.0.
References
| Link | Resource |
|---|---|
| https://github.com/statamic/cms/security/advisories/GHSA-qm7r-wwq7-6f85 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
23 Mar 2026, 18:46
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/statamic/cms/security/advisories/GHSA-qm7r-wwq7-6f85 - Vendor Advisory | |
| First Time |
Statamic statamic
Statamic |
|
| CPE | cpe:2.3:a:statamic:statamic:*:*:*:*:*:*:*:* |
20 Mar 2026, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-20 22:16
Updated : 2026-03-23 18:46
NVD link : CVE-2026-33171
Mitre link : CVE-2026-33171
CVE.ORG link : CVE-2026-33171
JSON object : View
Products Affected
statamic
- statamic
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')