CVE-2026-33171General(statamic / statamic)

LOWCVSS 4.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch statamic statamic systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, authenticated Control Panel users could read arbitrary `.json`, `.yaml`, and `.csv` files from the server by manipulating the file dictionary's `filename` configuration parameter in the fieldtype's endpoint. This has been fixed in 5.73.14 and 6.7.0.

statamic CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/statamic/cms/security/advisories/GHSA-qm7r-wwq7-6f85

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

statamic

Threat summary

Patch or workaround signal is available
4 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
General: 2 classified signals
Disclosure: 1 classified signal
Peaked 1d ago at 3 mentions (2026-03-18); latest day: 1
4 total mentions across 2 days

Affected systems

Vendors

statamic

Products

statamic

Deep dive

Activity timeline4 mentions / 2d

Signal classification3 categories

General

250.0%

Disclosure

125.0%

Patch

125.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-18	3	Disclosure1General2
2026-03-21	1	Patch1

Full discourse4 posts

𝕏 Bug Bounty Writeups 𝕏@bountywriteups205d
General
CVE-2026-33171: Path Traversal in Statamic CMS https://snehbavarva.medium.com/cve-2026-33171-path-traversal-in-statamic-cms-2680edd307cd?source=rss------bug_bounty-5 #bugbounty #bugbountytips #bugbountytip
Post summary
The post links to an article about CVE-2026-33171, but does not include any PoC, exploit, patch information, or technical details, so it remains a general mention.
010189956
40.3K followersView on X
CVE@CVEnew202d
Patch
CVE-2026-33171 Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, authenticated Control Panel users could read arbitrary `.j… https://www.cve.org/CVERecord?id=CVE-2026-33171
Post summary
Statamic allows authenticated Control Panel users to read arbitrary data via the CMS before versions 5.73.14 and 6.7.0; those releases include the necessary patch.
00000135
56.8K followersView on X
‘BBWriteups’@bbwriteup205d
Disclosure
"CVE-2026-33171: Path Traversal in Statamic CMS" by Sneh Bavarva #BugBounty #Cybersecurity #Hacking #InfoSec https://snehbavarva.medium.com/cve-2026-33171-path-traversal-in-statamic-cms-2680edd307cd
Post summary
The post announces the disclosure of CVE‑2026‑33171, a path traversal vulnerability in Statamic CMS, without providing PoC, exploit code or evidence of active exploitation.
0000049
532 followersView on X
Sneh Bavarva@BavarvaSneh205d
General
CVE-2026-33171 Few more on the way!!
Post summary
The text only references a CVE identifier with no additional context or details.
0000049
87 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	statamic	statamic	-	-	-

Explore more

Back to dashboard statamic CVEs statamic vulnerabilities