The vulnerability allows a control panel user with Antlers‑enabled field access to retrieve sensitive application configuration values by inserting configuration variable references into content fields. This leads to leakage of potentially confidential settings such as database credentials, API keys, and other environment variables. The weakness corresponds to improper information disclosure (CWE‑200).

The affected product is Statamic CMS. Versions starting from 5.7.12 up to, but not including, 5.73.16, and from 6.7.0 up to, but not including, 6.7.2 are vulnerable. Upstream updates to 5.73.16 and 6.7.2 contain the fix.

The CVSS score of 6.5 indicates moderate severity. EPSS is below 1 %, meaning the likelihood of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to have control‑panel access to configure Antlers syntax; once authenticated, the attacker can embed configuration variables and read secrets. Because the attack vector is internal to the CMS, it is limited to users with editing permissions, but the impact remains significant if privileged users are compromised.