CVE-2023-48701 - CVE House
Back to Database
Status published High CVE-2023-48701

Statamic CMS vulnerable to Cross-site Scripting via uploaded assets

Vulnerability Description

Statamic CMS is a Laravel and Git powered content management system (CMS). Prior to versions 3.4.15 an 4.36.0, HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the "Forms" feature containing an assets field, or within the control panel which requires authentication. This issue has been patched on 3.4.15 and 4.36.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-48701

Credits & Attribution

No credits recorded in the NVD database.

References

More from statamic

View All →
CVE-2025-64112
Statmatic vulnerable to Stored Cross-Site Scripting
High 8
CVE-2024-52600
Statamic CMS has Path Traversal in Asset Upload
Medium 5.3
CVE-2024-36119
Password confirmation stored in plain text via registration form in statamic/cms
Low 1.8
CVE-2024-24570
Statamic account takeover via XSS and password reset link
High 8.2
CVE-2023-48217
Remote code execution via form uploads in statamic/cms
High 8.8

Affected Vendor

Affected Software

cms
Vulnerable Versions:
< 3.4.15 , >= 4.0.0, < 4.36.0

Timeline

Official Publish: November 21st, 2023
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:H

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact