CVE-2026-71435

MEDIUM 6.1

Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template

CVSS Score

6.1

EPSS Score

0.0%

EPSS Percentile

0th

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, the default ("automagic") form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the configured recipients. This issue is fixed in versions 5.74.3 and 6.24.2.

CWE	CWE-79
Vendor	statamic
Product	cms
Published	Aug 6, 2026

Stay Ahead of the Next One

Get instant alerts for statamic cms

Be the first to know when new medium vulnerabilities affecting statamic cms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

statamic / cms

< 5.74.3 >= 6.0.0, < 6.24.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/statamic/cms/security/advisories/GHSA-vx89-p3j7-8xqc github.com: https://github.com/statamic/cms/pull/14959 github.com: https://github.com/statamic/cms/commit/4ad1335e818a67249d0617f0f167a1198fb96a2c github.com: https://github.com/statamic/cms/releases/tag/v5.74.3 github.com: https://github.com/statamic/cms/releases/tag/v6.24.2