CVE-2024-24570
Statamic account takeover via XSS and password reset link
Statamic is a Laravel and Git powered CMS. HTML files crafted to look like jpg files are able to be uploaded, allowing for XSS. This affects the front-end forms with asset fields without any mime type validation, asset fields in the control panel, and asset browser in the control panel. Additionally, if the XSS is crafted in a specific way, the "copy password reset link" feature may be exploited to gain access to a user's password reset token and gain access to their account. The authorized user is required to execute the XSS in order for the vulnerability to occur. In versions 4.46.0 and 3.4.17, the XSS vulnerability has been patched, and the copy password reset link functionality has been disabled.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Statamic account takeover via XSS and password reset link
Statamic is a Laravel and Git powered CMS. HTML files crafted to look like jpg files are able to be uploaded, allowing for XSS. This affects the front-end forms with asset fields without any mime type validation, asset fields in the control panel, and asset browser in the control panel. Additionally, if the XSS is crafted in a specific way, the "copy password reset link" feature may be exploited to gain access to a user's password reset token and gain access to their account. The authorized user is required to execute the XSS in order for the vulnerability to occur. In versions 4.46.0 and 3.4.17, the XSS vulnerability has been patched, and the copy password reset link functionality has been disabled.
- Record
CVE-2024-24570- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2024-0740
Statamic is a Laravel and Git powered CMS. HTML files crafted to look like jpg files are able to be uploaded, allowing for XSS. This affects the front-end forms with asset fields without any mime type validation, asset fields in the control panel, and asset browser in the control panel. Additionally, if the XSS is crafted in a specific way, the "copy password reset link" feature may be exploited to gain access to a user's password reset token and gain access to their account. The authorized user is required to execute the XSS in order for the vulnerability to occur. In versions 4.46.0 and 3.4.17, the XSS vulnerability has been patched, and the copy password reset link functionality has been disabled.
- Record
EUVD-2024-0740- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vqxq-hvxw-9mv9
Statmic CMS vulnerable to account takeover via XSS and password reset link
Impact
HTML files crafted to look like jpg files are able to be uploaded, allowing for XSS.
This affects:
- front-end forms with asset fields without any mime type validation
- asset fields in the control panel
- asset browser in the control panel
Additionally, if the XSS is crafted in a specific way, the "copy password reset link" feature may be exploited to gain access to a user's password reset token and gain access to their account. The authorized user is required to execute the XSS in order for the vulnerability to occur.
Patches
In versions 4.46.0 and 3.4.17, the XSS vulnerability has been patched, and the copy password reset link functionality has been disabled. (Users may still trigger password reset emails.)
Credits
Statamic thanks Niklas Schilling (discovery, analysis, coordination) from the SEC Consult Vulnerability Lab (https://www.sec-consult.com/) for responsibly reporting the identified issues and working with us as we addressed them.
- Record
GHSA-vqxq-hvxw-9mv9- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
NVD
Statamic is a Laravel and Git powered CMS. HTML files crafted to look like jpg files are able to be uploaded, allowing for XSS. This affects the front-end forms with asset fields without any mime type validation, asset fields in the control panel, and asset browser in the control panel. Additionally, if the XSS is crafted in a specific way, the "copy password reset link" feature may be exploited to gain access to a user's password reset token and gain access to their account. The authorized user is required to execute the XSS in order for the vulnerability to occur. In versions 4.46.0 and 3.4.17, the XSS vulnerability has been patched, and the copy password reset link functionality has been disabled.
- Record
CVE-2024-24570- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Statamic account takeover via XSS and password reset link
Statamic is a Laravel and Git powered CMS. HTML files crafted to look like jpg files are able to be uploaded, allowing for XSS. This affects the front-end forms with asset fields without any mime type validation, asset fields in the control panel, and asset browser in the control panel. Additionally, if the XSS is crafted in a specific way, the "copy password reset link" feature may be exploited to gain access to a user's password reset token and gain access to their account. The authorized user is required to execute the XSS in order for the vulnerability to occur. In versions 4.46.0 and 3.4.17, the XSS vulnerability has been patched, and the copy password reset link functionality has been disabled.
- Record
CVE-2024-24570- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-vqxq-hvxw-9mv9
Statmic CMS vulnerable to account takeover via XSS and password reset link
Impact
HTML files crafted to look like jpg files are able to be uploaded, allowing for XSS.
This affects:
- front-end forms with asset fields without any mime type validation
- asset fields in the control panel
- asset browser in the control panel
Additionally, if the XSS is crafted in a specific way, the "copy password reset link" feature may be exploited to gain access to a user's password reset token and gain access to their account. The authorized user is required to execute the XSS in order for the vulnerability to occur.
Patches
In versions 4.46.0 and 3.4.17, the XSS vulnerability has been patched, and the copy password reset link functionality has been disabled. (Users may still trigger password reset emails.)
Credits
Statamic thanks Niklas Schilling (discovery, analysis, coordination) from the SEC Consult Vulnerability Lab (https://www.sec-consult.com/) for responsibly reporting the identified issues and working with us as we addressed them.
- Record
GHSA-vqxq-hvxw-9mv9- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
statamic/cmsPackagist |
4.00 up to 4.46.0 | 4.46.0 |
statamic/cmsPackagist |
before 3.4.17 | 3.4.17 |
statamic/cmsPackagist |
4.00 up to 4.46.0, plus listed versions v4.0.0v4.0.0-alpha.1v4.0.0-alpha.2v4.0.0-alpha.3v4.0.0-alpha.4 Show 45 moreShow lessv4.0.0-alpha.5v4.0.0-beta.1v4.0.0-beta.2v4.0.0-beta.3v4.0.0-beta.4v4.1.0v4.1.1v4.1.2v4.1.3v4.10.0v4.10.1v4.10.2v4.11.0v4.12.0v4.13.0v4.13.1v4.13.2v4.14.0v4.15.0v4.16.0v4.17.0v4.18.0v4.19.0v4.2.0v4.20.0v4.21.0v4.22.0v4.23.0v4.23.1v4.23.2v4.24.0v4.25.0v4.26.0v4.26.1v4.27.0v4.28.0v4.29.0v4.3.0v4.30.0v4.31.0v4.32.0v4.33.0v4.34.0v4.35.0v4.36.0 |
4.46.0 |
statamic/cmsPackagist |
before 3.4.17, plus listed versions v3.0.0v3.0.0-beta.1v3.0.0-beta.10v3.0.0-beta.11v3.0.0-beta.12 Show 45 moreShow lessv3.0.0-beta.13v3.0.0-beta.14v3.0.0-beta.15v3.0.0-beta.16v3.0.0-beta.17v3.0.0-beta.18v3.0.0-beta.19v3.0.0-beta.2v3.0.0-beta.20v3.0.0-beta.21v3.0.0-beta.22v3.0.0-beta.23v3.0.0-beta.24v3.0.0-beta.25v3.0.0-beta.26v3.0.0-beta.27v3.0.0-beta.28v3.0.0-beta.29v3.0.0-beta.3v3.0.0-beta.30v3.0.0-beta.31v3.0.0-beta.32v3.0.0-beta.33v3.0.0-beta.34v3.0.0-beta.35v3.0.0-beta.36v3.0.0-beta.37v3.0.0-beta.38v3.0.0-beta.39v3.0.0-beta.4v3.0.0-beta.40v3.0.0-beta.41v3.0.0-beta.42v3.0.0-beta.43v3.0.0-beta.44v3.0.0-beta.45v3.0.0-beta.46v3.0.0-beta.5v3.0.0-beta.6v3.0.0-beta.7v3.0.0-beta.8v3.0.0-beta.9v3.0.1v3.0.10v3.0.11 |
3.4.17 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-24570 is a high vulnerability (CVSS 8.2) in Statamic Cms, published February 1, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.73%, the 54th percentile. Fixed in statamic/cms 4.46.0.
References
github.com/statamic/cms/security/advisories/GHSA-vqxq-hvxw-9mv9
seclists.org/fulldisclosure/2024/Feb/17
packetstormsecurity.com/files/177133/Statamic-CMS-Cross-Site-Scripting.html
nvd.nist.gov/vuln/detail/CVE-2024-24570
Left out here: 243 versions. The JSON record has them.