CVE-2023-48217 - CVE House

Back to Database

Status published High CVE-2023-48217

Remote code execution via form uploads in statamic/cms

8.8 CVSS

Vulnerability Description

Statamic is a flat-first, Laravel + Git powered CMS designed for building websites. In affected versions certain additional PHP files crafted to look like images may be uploaded regardless of mime type validation rules. This affects front-end forms using the "Forms" feature, and asset upload fields in the control panel. Malicious users could leverage this vulnerability to upload and execute code. This issue has been patched in versions 3.4.14 and 4.34.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-48217

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from statamic

View All →

Statmatic vulnerable to Stored Cross-Site Scripting

Statamic CMS has Path Traversal in Asset Upload

Password confirmation stored in plain text via registration form in statamic/cms

Statamic account takeover via XSS and password reset link

Statamic CMS vulnerable to Cross-site Scripting via uploaded assets

Affected Vendor

statamic

View all reports →

Affected Software

cms

Vulnerable Versions:

>= 4.0.0, < 4.34.0, < 3.4.14

Timeline

Official Publish: November 14th, 2023

Last Modified: August 30th, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1505.003 Web Shell

T1105 Ingress Tool Transfer

Command and Control

T1565.002 Stored Data Manipulation