p PatchFirst

CVE-2026-33886

CVE-2026-33886 · Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Statamic is a Laravel and Git powered content management system (CMS). Starting in version 5.7.12 and prior to versions 5.73.16 and 6.7.2, a control panel user with access to Antlers-enabled fields could access sensitive application configuration values by inserting config variables into their content. This has been fixed in 5.73.16 and 6.7.2.

CVSS 6.5 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • cms

    Versions
    • >= 5.73.12, < 5.73.16: Affected
    • >= 6.0.0.alpha.1, < 6.7.2: Affected

    No fix published

  • statamic/cms Packagist

    Versions
    • v5.73.12
    • v5.73.13
    • v5.73.14
    • v5.73.15
    Affected ranges
    • ECOSYSTEM: ≥ 5.73.12, < 5.73.16

    Update to 5.73.16

  • statamic/cms Packagist

    Versions
    • v6.5.0
    • v6.6.0
    • v6.6.1
    • v6.6.2
    • v6.6.3
    • v6.7.0
    • v6.7.1
    Affected ranges
    • ECOSYSTEM: ≥ 6.5.0, < 6.7.2

    Update to 6.7.2

Original sources

Check your server →