UpHeron
All vulnerabilities

Servers and applications

CVE-2023-48701

XSS via uploaded assets

Severity
Medium 6.1
Published
21 Nov 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
3.4.15, 4.36.0
Also known as
GHSA-8jjh-j3c2-cjcv
Sources
NVD, Project advisories (GitHub)

Description

Statamic CMS is a Laravel and Git powered content management system (CMS). Prior to versions 3.4.15 an 4.36.0, HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the "Forms" feature containing an assets field, or within the control panel which requires authentication. This issue has been patched on 3.4.15 and…

Affected software

SoftwareAffected versions
StatamicServers and applications · cpe:a:statamic:statamic
  • Every version before 3.4.15
  • From 4.0.0 before 4.36.0
StatamicServers and applications · github:statamic/cms
  • Every version before 3.4.15

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-48701
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-48701
  • GitHub Advisory Database https://github.com/advisories/GHSA-8jjh-j3c2-cjcv
  • github.com https://github.com/statamic/cms/security/advisories/GHSA-8jjh-j3c2-cjcv