Statamic CMS, built on Laravel, is vulnerable to unsafe method invocation through its Antlers templating system. The flaw allows a malicious actor to inject user‑supplied input that the template engine resolves into method calls. When such untrusted input is incorporated into a template, content and asset files can be inadvertently removed, resulting in permanent data loss. This weakness is a classic CWE‑470 scenario where arbitrary code execution is triggered via unsanitized method names.

The vulnerability affects Statamic CMS versions earlier than 5.74.1 and 6.24.0. Any deployment that accepts untrusted input in Antlers templates without proper filtering is at risk. The affected product is Statamic CMS across its 5.x and 6.x branches.

The CVSS score of 6.5 indicates a moderate severity, and the issue does not require authentication, meaning any user with access to provide template content can exploit it. The EPSS score is not available, so the precise likelihood is unknown, and the vulnerability is not listed in CISA's KEV catalogue. The likely attack vector is the injection of crafted content into templates via web forms or other input mechanisms, which the engine then executes, leading to data deletion. Given the accessibility of the attack surface and the severe consequence of data loss, organizations should treat this as a significant risk until a patch is applied.