Statamic's Markdown preview endpoint exposes sensitive user data

TRUNG BÌNH 6.5CVE-2026-33882 · GHSA-cvh3-23vq-w7h4 · Công bố 27/03/2026 · cập nhật 26/10/2026

Tóm tắt nhanh

CVE-2026-33882 là lỗ hổng mức TRUNG BÌNH (CVSS 6.5) ảnh hưởng statamic/cms, statamic (statamic).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.27%, cao hơn 18.4% các lỗ hổng khác.
Cách xử lý: cập nhật lên 6.7.2, 5.73.16 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
statamic/cms Packagist	`≥ 6.0.0-alpha.1, < 6.7.2< 5.73.16`	`6.7.25.73.16`
statamic statamic	`≥ 6.0.0, < 6.7.2< 5.73.16`	`6.7.25.73.16`

Mô tả

Impact

The markdown preview endpoint could be manipulated to return augmented data from arbitrary fieldtypes. With the users fieldtype specifically, an authenticated control panel user could retrieve sensitive user data including email addresses, encrypted passkey data, and encrypted two-factor authentication codes.

Patches

This has been fixed in 5.73.16 and 6.7.2.

Mô tả của NVD

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the markdown preview endpoint could be manipulated to return augmented data from arbitrary fieldtypes. With the users fieldtype specifically, an authenticated control panel user could retrieve sensitive user data including email addresses, encrypted passkey data, and encrypted two-factor authentication codes. This has been fixed in 5.73.16 and 6.7.2.