High
Statamic CMS vulnerable to Cross-site Scripting via uploaded assets
Type: advisorySources: OSV
Statamic CMS is a Laravel and Git powered content management system (CMS). Prior to versions 3.4.15 an 4.36.0, HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the "Forms" feature containing an assets field, or within the control panel which requires authentication. This issue has been patched on 3.4.15 and 4.36.0.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2023-48701
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 20:36 UTC · Revision 1
Source evidence
Statamic CMS vulnerable to Cross-site Scripting via uploaded assets
core-osv · Original sourcePublished 21 Nov 2023, 22:34 UTC
Statamic CMS is a Laravel and Git powered content management system (CMS). Prior to versions 3.4.15 an 4.36.0, HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the "Forms" feature containing an assets field, or within the control panel which requires authentication. This issue has been patched on 3.4.15 and 4.36.0.
osv:CVE-2023-48701
Complete source record
{
"id": "425769e33a5a3749bab9808f584b34cd9fc6a828a92b51a73264ed6527f4798b",
"url": "https://osv.dev/vulnerability/CVE-2023-48701",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Statamic CMS vulnerable to Cross-site Scripting via uploaded assets",
"summary": "Statamic CMS is a Laravel and Git powered content management system (CMS). Prior to versions 3.4.15 an 4.36.0, HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the \"Forms\" feature containing an assets field, or within the control panel which requires authentication. This issue has been patched on 3.4.15 and 4.36.0.",
"evidence": "osv:CVE-2023-48701",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2023-48701",
"aliases": [
"CVE-2023-48701",
"GHSA-8jjh-j3c2-cjcv"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/statamic/cms",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "8f7c1ae834005a8537b420c903ffe0aa4ca6f45a"
},
{
"introduced": "79f5628550a21c4a02c2787f81fbfc165a1c97fe"
},
{
"fixed": "2dbbb0f87cda409c794516d2bbbf80841fb92c95"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:statamic:statamic:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "3.4.15"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:statamic:statamic:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.36.0"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "8f7c1ae834005a8537b420c903ffe0aa4ca6f45a"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v3.4.15"
},
{
"range": [
{
"fixed": "2dbbb0f87cda409c794516d2bbbf80841fb92c95"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v4.36.0"
}
]
}
}
],
"versions": [
"v3.4.14",
"v4.35.0",
"v4.34.0",
"v3.4.13",
"v3.4.12",
"v4.33.0",
"v4.32.0",
"v4.31.0",
"v4.30.0",
"v4.29.0",
"v4.28.0",
"v4.27.0",
"v4.26.1",
"v4.26.0",
"v4.25.0",
"v4.24.0",
"v4.23.2",
"v4.23.1",
"v4.23.0",
"v4.22.0",
"v4.21.0",
"v4.20.0",
"v4.19.0",
"v4.18.0",
"v4.17.0",
"v4.16.0",
"v4.15.0",
"v4.14.0",
"v4.13.2",
"v4.13.1",
"v4.13.0",
"v4.12.0",
"v4.11.0",
"v4.10.2",
"v4.10.1",
"v4.10.0",
"v4.9.2",
"v4.9.1",
"v4.9.0",
"v4.8.0",
"v4.7.0",
"v4.6.0",
"v4.5.0",
"v4.4.0",
"v4.3.0",
"v4.2.0",
"v4.1.3",
"v4.1.2",
"v4.1.1",
"v4.1.0",
"v3.4.11",
"v4.0.0",
"v3.4.10",
"v3.4.9",
"v3.4.8",
"v3.4.7",
"v3.4.6",
"v3.4.5",
"v3.4.4",
"v3.4.3",
"v3.4.2",
"v3.4.1",
"v3.4.0",
"v3.3.16",
"v3.3.15",
"v3.3.14",
"v3.3.13",
"v3.3.12",
"v3.3.11",
"v3.3.10",
"v3.3.9",
"v3.3.8",
"v3.3.7",
"v3.3.6",
"v3.3.5",
"v3.3.4",
"v3.3.3",
"v3.3.2",
"v3.3.1",
"v3.3.0",
"v3.3.0-beta.7",
"v3.3.0-beta.6",
"v3.3.0-beta.5",
"v3.3.0-beta.4",
"v3.3.0-beta.3",
"v3.3.0-beta.2",
"v3.3.0-beta.1",
"v3.2.30",
"v3.2.29",
"v3.2.28",
"v3.2.27",
"v3.2.26",
"v3.2.25",
"v3.2.24",
"v3.2.23",
"v3.2.22",
"v3.2.21",
"v3.2.20",
"v3.2.19",
"v3.2.18",
"v3.2.17",
"v3.2.16",
"v3.2.15",
"v3.2.14",
"v3.2.13",
"v3.2.12",
"v3.2.11",
"v3.2.10",
"v3.2.9",
"v3.2.8",
"v3.2.7",
"v3.2.6",
"v3.2.5",
"v3.2.4",
"v3.2.3",
"v3.2.2",
"v3.2.1",
"v3.2.0",
"v3.2.0-beta.1",
"v3.1.0",
"v3.1.0-beta.3",
"v3.1.0-beta.2",
"v3.1.0-beta.1",
"v3.1.0-alpha.4",
"v3.1.0-alpha.3",
"v3.1.0-alpha.2",
"v3.1.0-alpha.1",
"v3.0.35",
"v3.0.34",
"v3.0.33",
"v3.0.32",
"v3.0.31",
"v3.0.30",
"v3.0.29",
"v3.0.28",
"v3.0.27",
"v3.0.26",
"v3.0.25",
"v3.0.24",
"v3.0.23",
"v3.0.22",
"v3.0.21",
"v3.0.20",
"v3.0.19",
"v3.0.18",
"v3.0.17",
"v3.0.16",
"v3.0.15",
"v3.0.14",
"v3.0.13",
"v3.0.12",
"v3.0.11",
"v3.0.10",
"v3.0.9",
"v3.0.8",
"v3.0.7",
"v3.0.6",
"v3.0.5",
"v3.0.4",
"v3.0.3",
"v3.0.2",
"v3.0.1",
"v3.0.0",
"v3.0.0-beta.46",
"v3.0.0-beta.45",
"v3.0.0-beta.44",
"v3.0.0-beta.43",
"v3.0.0-beta.42",
"v3.0.0-beta.41",
"v3.0.0-beta.40",
"v3.0.0-beta.39",
"v3.0.0-beta.38",
"v3.0.0-beta.37",
"v3.0.0-beta.36",
"v3.0.0-beta.35",
"v3.0.0-beta.34",
"v3.0.0-beta.33",
"v3.0.0-beta.32",
"v3.0.0-beta.31",
"v3.0.0-beta.30",
"v3.0.0-beta.29",
"v3.0.0-beta.28",
"v3.0.0-beta.27",
"v3.0.0-beta.26",
"v3.0.0-beta.25",
"v3.0.0-beta.17",
"v3.0.0-beta.16",
"v3.0.0-beta.15"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-48701.json"
}
}
],
"modified": "2026-10-28T02:30:23.601517196Z",
"provider": "osv",
"references": [
"https://github.com/statamic/cms/releases/tag/v3.4.15",
"https://github.com/statamic/cms/releases/tag/v4.36.0",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48701.json",
"https://github.com/statamic/cms/security/advisories/GHSA-8jjh-j3c2-cjcv",
"https://nvd.nist.gov/vuln/detail/CVE-2023-48701"
],
"provider_metadata": {
"cwe_ids": [
"CWE-79"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48701.json"
}
},
"related_cves": [
{
"value": "CVE-2023-48701",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 489941,
"published_at": "2023-11-21T22:34:11.043+00:00"
}