CVE-2026-49287

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.73.23 Statamic versions prior to 6.20.0

Description An incomplete fix for a previous issue in this Laravel and Git powered content management system (CMS) left in-memory collection sorting unprotected, although the query builder was secured. If a front-end template is explicitly configured to pass request input into a tag's sort parameter, manipulating these sort parameters could lead to the loss of content and assets.

Recommendations Update to version 5.73.23. Update to version 6.20.0.