Statamic CMS was found to allow unsafe method invocation during in‑memory collection sorting when the sort parameter comes from request input. The flaw, classified as CWE-470, permits attackers to manipulate sorting logic and trigger the deletion or loss of stored content and assets. The impact is the compromise of data integrity and availability, resulting in loss of published material and associated media.

The vulnerability affects Statamic CMS versions prior to 5.73.23 and 6.20.0. Users running these releases are susceptible when a front‑end template passes visitor‑controlled values directly to a tag's sort parameter.

The CVSS score of 7.4 indicates a high severity. EPSS data is unavailable, and the issue is not listed in CISA's KEV catalog. Exploitation requires a template explicitly configured to sort by a user‑controlled value, meaning the vulnerability is not exploitable out of the box but could be leveraged if the template author inadvertently introduces the flaw. Attackers would manipulate the sort parameter to trigger unsafe method calls that can wipe or corrupt data.