← Back

CVE-2026-33886

nvd nist
Published: Mar 27, 2026Modified: Apr 8, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Exploitability: 2.8 / Impact: 3.6
Source: security-advisories@github.com (Secondary)

Description

Statamic is a Laravel and Git powered content management system (CMS). Starting in version 5.7.12 and prior to versions 5.73.16 and 6.7.2, a control panel user with access to Antlers-enabled fields could access sensitive application configuration values by inserting config variables into their content. This has been fixed in 5.73.16 and 6.7.2.

Affected (2)

Products: Statamic: Statamic
Statamic
1 product
Statamic
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Statamic
Statamic
From 5.73.12 to 5.73.16
Statamic
From 6.5.0 to 6.7.2

Related CWEs

CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (1)

Source: security-advisories@github.com
Vendor Advisory

Timeline

No history available yet.