← Back

CVE-2026-33885

nvd nist
Published: Mar 27, 2026Modified: Apr 8, 2026

JSON object

Loading...
6.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Exploitability: 2.8 / Impact: 2.7
Source: security-advisories@github.com (Secondary)

Description

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the external URL detection used for redirect validation on unauthenticated endpoints could be bypassed, allowing users to be redirected to external URLs after actions like form submissions and authentication flows. This has been fixed in 5.73.16 and 6.7.2.

Affected (2)

Products: Statamic: Statamic
Statamic
1 product
Statamic
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Statamic
Statamic
Before 5.73.16
Statamic
From 6.0.0 to 6.7.2

Related CWEs

CWE-601
URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

References (1)

Source: security-advisories@github.com
Vendor Advisory

Timeline

No history available yet.