Statamic CMS allowed unauthenticated visitors to submit file uploads through public frontend forms without enforcing the same restrictions that the Control Panel applies. The lack of validation meant that administrators could have disallowed certain file types in form configuration, yet attackers were still able to upload those files. Though the global upload allowlist blocks executable types such as .php and .html, the vulnerability permitted the addition of otherwise prohibited assets to publicly accessible storage disks, increasing the risk of unintended data exposure or future exploitation through other vectors.

Statamic CMS v5.x releases prior to 5.74.3 and v6.x releases prior to 6.24.2 are affected. The vulnerability originates in the statamic:cms product and affects any installation that exposes frontend forms with asset or files fields.

With a CVSS score of 5.3, the risk is moderate. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is unauthenticated web submissions to public forms, enabling upload of disallowed file types that can be stored on a public disk. While the vulnerability does not provide immediate code execution, it facilitates data exfiltration or sets the stage for future attacks by placing files in locations accessible to external users.