CVE-2026-64663

Katalog CVE

CVSS 6.5 · Medium EPSS 0,40%

Kerentanan Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection'). Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, manipulating user-supplied input incorporated into Antlers templates could result in the loss of content and assets, on sites whose templates pass untrusted input into affected areas, and exploitation did not require authentication. This issue is fixed in versions 5.74.1 and 6.24.0.

Rincian

Terbit di NVD

6 Agustus 2026

Terakhir diubah

8 September 2026

Status NVD

Deferred

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 31,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/statamic/cms/security/advisories/GHSA-j2vp-f2pv-5rj4