What is CVE-2026-64663?

CVE-2026-64663 is a medium-severity vulnerability in Statamic Cms, classified under Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection). CVSS score: 6.5/10. Published 2026-08-06.

How severe is CVE-2026-64663?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Statamic Cms

CVE-2026-64663

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, manipulating user-supplied input incorporated into Antlers templates could result in the loss of content and assets, on sites whose template…

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H.

Affected products

Statamic Cms — versions < 5.74.1, >= 6.0.0, < 6.24.0

Weakness classification (CWE)

CWE-470 — Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection)

References

security-advisories@github.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-64663?: CVE-2026-64663 is a medium-severity vulnerability in Statamic Cms, classified under Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection). CVSS score: 6.5/10. Published 2026-08-06.
How severe is CVE-2026-64663?: Medium severity. CVSS v3 base score is 6.5 out of 10.