CVE-2023-48701
Statamic CMS vulnerable to Cross-site Scripting via uploaded assets
Statamic CMS is a Laravel and Git powered content management system (CMS). Prior to versions 3.4.15 an 4.36.0, HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the "Forms" feature containing an assets field, or within the control panel which requires authentication. This issue has been patched on 3.4.15 and 4.36.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Statamic CMS vulnerable to Cross-site Scripting via uploaded assets
Statamic CMS is a Laravel and Git powered content management system (CMS). Prior to versions 3.4.15 an 4.36.0, HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the "Forms" feature containing an assets field, or within the control panel which requires authentication. This issue has been patched on 3.4.15 and 4.36.0.
- Record
CVE-2023-48701- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2023-2924
Statamic CMS is a Laravel and Git powered content management system (CMS). Prior to versions 3.4.15 an 4.36.0, HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the "Forms" feature containing an assets field, or within the control panel which requires authentication. This issue has been patched on 3.4.15 and 4.36.0.
- Record
EUVD-2023-2924- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8jjh-j3c2-cjcv
Cross-site Scripting via uploaded assets
Impact
HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the "Forms" feature containing an assets field, or within the control panel which requires authentication.
Patches
It has been patched on 3.4.15 and 4.36.0.
- Record
GHSA-8jjh-j3c2-cjcv- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Statamic CMS is a Laravel and Git powered content management system (CMS). Prior to versions 3.4.15 an 4.36.0, HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the "Forms" feature containing an assets field, or within the control panel which requires authentication. This issue has been patched on 3.4.15 and 4.36.0.
- Record
CVE-2023-48701- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:H - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Statamic CMS vulnerable to Cross-site Scripting via uploaded assets
Statamic CMS is a Laravel and Git powered content management system (CMS). Prior to versions 3.4.15 an 4.36.0, HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the "Forms" feature containing an assets field, or within the control panel which requires authentication. This issue has been patched on 3.4.15 and 4.36.0.
- Record
CVE-2023-48701- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-8jjh-j3c2-cjcv
Cross-site Scripting via uploaded assets
Impact
HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the "Forms" feature containing an assets field, or within the control panel which requires authentication.
Patches
It has been patched on 3.4.15 and 4.36.0.
- Record
GHSA-8jjh-j3c2-cjcv- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
statamic/cmsPackagist |
before 3.4.15 | 3.4.15 |
statamic/cmsPackagist |
4.0.0 up to 4.36.0 | 4.36.0 |
statamic/cmsPackagist |
before 3.4.15, plus listed versions v3.0.0v3.0.0-beta.1v3.0.0-beta.10v3.0.0-beta.11v3.0.0-beta.12 Show 45 moreShow lessv3.0.0-beta.13v3.0.0-beta.14v3.0.0-beta.15v3.0.0-beta.16v3.0.0-beta.17v3.0.0-beta.18v3.0.0-beta.19v3.0.0-beta.2v3.0.0-beta.20v3.0.0-beta.21v3.0.0-beta.22v3.0.0-beta.23v3.0.0-beta.24v3.0.0-beta.25v3.0.0-beta.26v3.0.0-beta.27v3.0.0-beta.28v3.0.0-beta.29v3.0.0-beta.3v3.0.0-beta.30v3.0.0-beta.31v3.0.0-beta.32v3.0.0-beta.33v3.0.0-beta.34v3.0.0-beta.35v3.0.0-beta.36v3.0.0-beta.37v3.0.0-beta.38v3.0.0-beta.39v3.0.0-beta.4v3.0.0-beta.40v3.0.0-beta.41v3.0.0-beta.42v3.0.0-beta.43v3.0.0-beta.44v3.0.0-beta.45v3.0.0-beta.46v3.0.0-beta.5v3.0.0-beta.6v3.0.0-beta.7v3.0.0-beta.8v3.0.0-beta.9v3.0.1v3.0.10v3.0.11 |
3.4.15 |
statamic/cmsPackagist |
4.0.0 up to 4.36.0, plus listed versions v4.0.0v4.1.0v4.1.1v4.1.2v4.1.3 Show 43 moreShow lessv4.10.0v4.10.1v4.10.2v4.11.0v4.12.0v4.13.0v4.13.1v4.13.2v4.14.0v4.15.0v4.16.0v4.17.0v4.18.0v4.19.0v4.2.0v4.20.0v4.21.0v4.22.0v4.23.0v4.23.1v4.23.2v4.24.0v4.25.0v4.26.0v4.26.1v4.27.0v4.28.0v4.29.0v4.3.0v4.30.0v4.31.0v4.32.0v4.33.0v4.34.0v4.35.0v4.4.0v4.5.0v4.6.0v4.7.0v4.8.0v4.9.0v4.9.1v4.9.2 |
4.36.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-48701 is a high vulnerability (CVSS 7.5) in Statamic Cms, published November 21, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.70%, the 53rd percentile. Fixed in statamic/cms 3.4.15.
References
github.com/statamic/cms/security/advisories/GHSA-8jjh-j3c2-cjcv
nvd.nist.gov/vuln/detail/CVE-2023-48701
Left out here: 223 versions. The JSON record has them.