CVE-2023-47129 - CVE House
Back to Database
Status published High CVE-2023-47129

Statamic CMS remote code execution via front-end form uploads

Vulnerability Description

Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded. This only affects forms using the "Forms" feature and not just _any_ arbitrary form. This does not affect the control panel. This issue has been patched in 3.4.13 and 4.33.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-47129

Credits & Attribution

No credits recorded in the NVD database.

References

More from statamic

View All →
CVE-2025-64112
Statmatic vulnerable to Stored Cross-Site Scripting
High 8
CVE-2024-52600
Statamic CMS has Path Traversal in Asset Upload
Medium 5.3
CVE-2024-36119
Password confirmation stored in plain text via registration form in statamic/cms
Low 1.8
CVE-2024-24570
Statamic account takeover via XSS and password reset link
High 8.2
CVE-2023-48701
Statamic CMS vulnerable to Cross-site Scripting via uploaded assets
High 7.5

Affected Vendor

Affected Software

cms
Vulnerable Versions:
< 3.4.13, >= 4.0.0, < 4.33.0

Timeline

Official Publish: November 10th, 2023
Last Modified: September 3rd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-434

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1505.003 Web Shell
Persistence
T1105 Ingress Tool Transfer
Command and Control
T1059 Command and Scripting Interpreter
Execution
T1565.002 Stored Data Manipulation
Impact