Statamic, a Laravel‑based CMS, allows an authenticated control panel user to trigger arbitrary code execution through enabled Antlers templates in content fields. The flaw can elevate the attacker’s control within the application, permitting full compromise, data loss or theft, and disruption of service. The weakness is a classic code injection failure (CWE‑94).

The vulnerability affects Statamic CMS versions prior to 5.73.16 and 6.7.2. Any instance that has Antlers‑enabled fields in its content, configuration, or third‑party addons (e.g., SEO Pro) and grants an attacker the necessary edit permissions is at risk. Addons that expose such fields must be updated to a patched Statamic core version.

With a CVSS score of 8 the CVE is high severity, but the EPSS score of less than 1% indicates low likelihood of active exploitation. The flaw is not listed in CISA’s KEV catalog. Exploitation requires authenticated control panel access and the presence of Antlers‑enabled content, meaning the attack surface is limited to privileged users or compromised accounts. Once executed, the attacker can run arbitrary code within the application context, potentially accessing sensitive configuration and data.