UpHeron
All vulnerabilities

Servers and applications

CVE-2023-48217

Remote code execution via form uploads

Severity
High 8.8
Published
14 Nov 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
3.4.14, 4.34.0
Also known as
GHSA-2r53-9295-3m86
Sources
NVD, Project advisories (GitHub)

Description

Statamic is a flat-first, Laravel + Git powered CMS designed for building websites. In affected versions certain additional PHP files crafted to look like images may be uploaded regardless of mime type validation rules. This affects front-end forms using the "Forms" feature, and asset upload fields in the control panel. Malicious users could leverage this vulnerability to upload and execute…

Affected software

SoftwareAffected versions
StatamicServers and applications · cpe:a:statamic:statamic
  • Every version before 3.4.14
  • From 4.0.0 before 4.34.0
StatamicServers and applications · github:statamic/cms
  • Every version before 3.4.14

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-48217
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-48217
  • GitHub Advisory Database https://github.com/advisories/GHSA-2r53-9295-3m86
  • github.com https://github.com/statamic/cms/security/advisories/GHSA-2r53-9295-3m86