statamic/cms · Security
Statamic CMS remote code execution via front-end form uploads
- GHSA ID
- GHSA-72hg-5wr5-rmfc
- CVE ID
- CVE-2023-47129
- Severity
- high
- Published
- Updated
- CVSS
- 8.3 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
- CVSS v3
- 8.3 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Description
Impact
On front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded regardless of mime validation rules. This only affects forms using the "Forms" feature and not just any arbitrary form. This does not affect the control panel.
Patches
It has been patched in 3.4.13 and 4.33.0.
CWEs
- CWE-434 · Unrestricted Upload of File with Dangerous Type
References
- https://github.com/statamic/cms/security/advisories/GHSA-72hg-5wr5-rmfc ↗
- https://nvd.nist.gov/vuln/detail/CVE-2023-47129 ↗
- https://github.com/statamic/cms/commit/098ef8024d97286ca501273c18ae75b646262d75 ↗
- https://github.com/statamic/cms/commit/f6c688154f6bdbd0b67039f8f11dcd98ba061e77 ↗
- https://github.com/advisories/GHSA-72hg-5wr5-rmfc ↗