CVE-2026-71434

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.74.3 Statamic versions prior to 6.24.2

Description Public frontend forms fail to enforce the file upload restrictions configured in the Control Panel. This allows an unauthenticated visitor to upload file types that an administrator intended to disallow via the assets or files fields. In the case of assets fields, uploaded files may be stored on a public, web-accessible disk. However, the application's global upload allowlist continues to block executable file types such as .php and .html.

Recommendations Update to version 5.74.3. Update to version 6.24.2.