Arbitrary file upload in Statamic Cms
CVE-2023-47129
Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded. This only affects forms using…
Vulnerability class: Unrestricted File Upload
EPSS: 0.060 (90.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.4 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H.
Affected products
- Statamic Cms — versions < 3.4.13, >= 4.0.0, < 4.33.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- https://github.com/statamic/cms/security/advisories/GHSA-72hg-5wr5-rmfc (x_refsource_CONFIRM)
- https://github.com/statamic/cms/commit/098ef8024d97286ca501273c18ae75b646262d75 (x_refsource_MISC)
- https://github.com/statamic/cms/commit/f6c688154f6bdbd0b67039f8f11dcd98ba061e77 (x_refsource_MISC)
Frequently asked questions
- What is CVE-2023-47129?
- CVE-2023-47129 is a high-severity vulnerability in Statamic Cms, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 8.4/10. Published 2023-11-10.
- How severe is CVE-2023-47129?
- High severity. CVSS v3 base score is 8.4 out of 10.
- Is CVE-2023-47129 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.