Cross-site Scripting via uploaded assets

TRUNG BÌNH 6.1CVE-2023-48701 · GHSA-8jjh-j3c2-cjcv · Công bố 21/11/2023 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2023-48701 là lỗ hổng mức TRUNG BÌNH (CVSS 6.1) ảnh hưởng statamic/cms, statamic (statamic).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.70%, cao hơn 53.2% các lỗ hổng khác.
Cách xử lý: cập nhật lên 4.36.0, 3.4.15 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
statamic/cms Packagist	`≥ 4.0.0, < 4.36.0< 3.4.15`	`4.36.03.4.15`
statamic statamic	`≥ 4.0.0, < 4.36.0< 3.4.15`	`4.36.03.4.15`

Mô tả

Impact

HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the "Forms" feature containing an assets field, or within the control panel which requires authentication.

Patches

It has been patched on 3.4.15 and 4.36.0.

Mô tả của NVD

Statamic CMS is a Laravel and Git powered content management system (CMS). Prior to versions 3.4.15 an 4.36.0, HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the "Forms" feature containing an assets field, or within the control panel which requires authentication. This issue has been patched on 3.4.15 and 4.36.0.