Statamic CMS contains an unauthenticated redirect vulnerability that enables attackers to cause visitors to be sent to arbitrary external sites. The flaw arises from incorrect validation of URL formats, allowing the bypass of external URL checks. This results in a classic open redirect (CWE‑601) that can be exploited for phishing or click‑jacking without compromising credentials.

The issue affects Statamic CMS versions earlier than 5.73.16 or 6.7.2. These releases, built on the Laravel framework and Git infrastructure, expose unauthenticated endpoints that process redirect URLs, making any instance of the affected versions susceptible.

The severity assessment assigns a moderate base score of 6.1. The estimated probability that this flaw will be actively exploited today is below one percent, indicating limited current exploitation. The vulnerability is not part of the known-exploited catalog. Because an attacker only needs to trigger an unauthenticated redirect endpoint, a broad attack surface exists, though the primary threat is social engineering rather than direct system compromise.