Skip to content
Heist/ feed
Back to feed
High

Statamic CMS remote code execution via front-end form uploads

Type: advisorySources: OSV

Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded. This only affects forms using the "Forms" feature and not just _any_ arbitrary form. This does not affect the control panel. This issue has been patched in 3.4.13 and 4.33.0.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2023-47129
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 23:20 UTC · Revision 1

Source evidence

Statamic CMS remote code execution via front-end form uploads

core-osv · Original source

Published 10 Nov 2023, 18:48 UTC

Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded. This only affects forms using the "Forms" feature and not just _any_ arbitrary form. This does not affect the control panel. This issue has been patched in 3.4.13 and 4.33.0.

osv:CVE-2023-47129
Complete source record
{
  "id": "f1f9e501d0d75b0b0a9181a8eb6b6fdc17781be9531f69d8f9f086f79b7ac5a4",
  "url": "https://osv.dev/vulnerability/CVE-2023-47129",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Statamic CMS remote code execution via front-end form uploads",
    "summary": "Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded. This only affects forms using the \"Forms\" feature and not just _any_ arbitrary form. This does not affect the control panel. This issue has been patched in 3.4.13 and 4.33.0.",
    "evidence": "osv:CVE-2023-47129",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2023-47129",
      "aliases": [
        "CVE-2023-47129",
        "GHSA-72hg-5wr5-rmfc"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/statamic/cms",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "14561f3d62fbba51a66c75f269630c1f060f110a"
                },
                {
                  "introduced": "79f5628550a21c4a02c2787f81fbfc165a1c97fe"
                },
                {
                  "fixed": "1c708549b927ef213be43b4044fc2d3e45d8843f"
                },
                {
                  "fixed": "098ef8024d97286ca501273c18ae75b646262d75"
                },
                {
                  "fixed": "f6c688154f6bdbd0b67039f8f11dcd98ba061e77"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:statamic:statamic:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "3.4.13"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:statamic:statamic:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "4.0.0"
                      },
                      {
                        "fixed": "4.33.0"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "098ef8024d97286ca501273c18ae75b646262d75"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "f6c688154f6bdbd0b67039f8f11dcd98ba061e77"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v3.4.12",
            "v4.32.0",
            "v4.31.0",
            "v4.30.0",
            "v4.29.0",
            "v4.28.0",
            "v4.27.0",
            "v4.26.1",
            "v4.26.0",
            "v4.25.0",
            "v4.24.0",
            "v4.23.2",
            "v4.23.1",
            "v4.23.0",
            "v4.22.0",
            "v4.21.0",
            "v4.20.0",
            "v4.19.0",
            "v4.18.0",
            "v4.17.0",
            "v4.16.0",
            "v4.15.0",
            "v4.14.0",
            "v4.13.2",
            "v4.13.1",
            "v4.13.0",
            "v4.12.0",
            "v4.11.0",
            "v4.10.2",
            "v4.10.1",
            "v4.10.0",
            "v4.9.2",
            "v4.9.1",
            "v4.9.0",
            "v4.8.0",
            "v4.7.0",
            "v4.6.0",
            "v4.5.0",
            "v4.4.0",
            "v4.3.0",
            "v4.2.0",
            "v4.1.3",
            "v4.1.2",
            "v4.1.1",
            "v4.1.0",
            "v3.4.11",
            "v4.0.0",
            "v3.4.10",
            "v3.4.9",
            "v3.4.8",
            "v3.4.7",
            "v3.4.6",
            "v3.4.5",
            "v3.4.4",
            "v3.4.3",
            "v3.4.2",
            "v3.4.1",
            "v3.4.0",
            "v3.3.16",
            "v3.3.15",
            "v3.3.14",
            "v3.3.13",
            "v3.3.12",
            "v3.3.11",
            "v3.3.10",
            "v3.3.9",
            "v3.3.8",
            "v3.3.7",
            "v3.3.6",
            "v3.3.5",
            "v3.3.4",
            "v3.3.3",
            "v3.3.2",
            "v3.3.1",
            "v3.3.0",
            "v3.3.0-beta.7",
            "v3.3.0-beta.6",
            "v3.3.0-beta.5",
            "v3.3.0-beta.4",
            "v3.3.0-beta.3",
            "v3.3.0-beta.2",
            "v3.3.0-beta.1",
            "v3.2.30",
            "v3.2.29",
            "v3.2.28",
            "v3.2.27",
            "v3.2.26",
            "v3.2.25",
            "v3.2.24",
            "v3.2.23",
            "v3.2.22",
            "v3.2.21",
            "v3.2.20",
            "v3.2.19",
            "v3.2.18",
            "v3.2.17",
            "v3.2.16",
            "v3.2.15",
            "v3.2.14",
            "v3.2.13",
            "v3.2.12",
            "v3.2.11",
            "v3.2.10",
            "v3.2.9",
            "v3.2.8",
            "v3.2.7",
            "v3.2.6",
            "v3.2.5",
            "v3.2.4",
            "v3.2.3",
            "v3.2.2",
            "v3.2.1",
            "v3.2.0",
            "v3.2.0-beta.1",
            "v3.1.0",
            "v3.1.0-beta.3",
            "v3.1.0-beta.2",
            "v3.1.0-beta.1",
            "v3.1.0-alpha.4",
            "v3.1.0-alpha.3",
            "v3.1.0-alpha.2",
            "v3.1.0-alpha.1",
            "v3.0.35",
            "v3.0.34",
            "v3.0.33",
            "v3.0.32",
            "v3.0.31",
            "v3.0.30",
            "v3.0.29",
            "v3.0.28",
            "v3.0.27",
            "v3.0.26",
            "v3.0.25",
            "v3.0.24",
            "v3.0.23",
            "v3.0.22",
            "v3.0.21",
            "v3.0.20",
            "v3.0.19",
            "v3.0.18",
            "v3.0.17",
            "v3.0.16",
            "v3.0.15",
            "v3.0.14",
            "v3.0.13",
            "v3.0.12",
            "v3.0.11",
            "v3.0.10",
            "v3.0.9",
            "v3.0.8",
            "v3.0.7",
            "v3.0.6",
            "v3.0.5",
            "v3.0.4",
            "v3.0.3",
            "v3.0.2",
            "v3.0.1",
            "v3.0.0",
            "v3.0.0-beta.46",
            "v3.0.0-beta.45",
            "v3.0.0-beta.44",
            "v3.0.0-beta.43",
            "v3.0.0-beta.42",
            "v3.0.0-beta.41",
            "v3.0.0-beta.40",
            "v3.0.0-beta.39",
            "v3.0.0-beta.38",
            "v3.0.0-beta.37",
            "v3.0.0-beta.36",
            "v3.0.0-beta.35",
            "v3.0.0-beta.34",
            "v3.0.0-beta.33",
            "v3.0.0-beta.32",
            "v3.0.0-beta.31",
            "v3.0.0-beta.30",
            "v3.0.0-beta.29",
            "v3.0.0-beta.28",
            "v3.0.0-beta.27",
            "v3.0.0-beta.26",
            "v3.0.0-beta.25",
            "v3.0.0-beta.17",
            "v3.0.0-beta.16",
            "v3.0.0-beta.15"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-47129.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:40.429447909Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47129.json",
        "https://github.com/statamic/cms/security/advisories/GHSA-72hg-5wr5-rmfc",
        "https://nvd.nist.gov/vuln/detail/CVE-2023-47129",
        "https://github.com/statamic/cms/commit/098ef8024d97286ca501273c18ae75b646262d75",
        "https://github.com/statamic/cms/commit/f6c688154f6bdbd0b67039f8f11dcd98ba061e77"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-434"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47129.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2023-47129",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 507938,
  "published_at": "2023-11-10T18:48:03.265+00:00"
}