CVE-2026-71435

Summary

Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template

Severity

medium

CVSS

6.1

EPSS

0.3% (p27)

CWE

CWE-79

Also known as

GHSA-vx89-p3j7-8xqc

Published

2026-08-06

Updated

2026-08-06

Advisory details

Impact

The default ("automagic") form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the configured recipients

Patches

This has been fixed in 5.74.3 and 6.24.2.

References

• https://github.com/advisories/GHSA-vx89-p3j7-8xqc
• https://github.com/statamic/cms/security/advisories/GHSA-vx89-p3j7-8xqc
• https://github.com/statamic/cms/pull/14959
• https://github.com/statamic/cms/commit/4ad1335e818a67249d0617f0f167a1198fb96a2c
• https://github.com/statamic/cms/releases/tag/v5.74.3
• https://github.com/statamic/cms/releases/tag/v6.24.2

Related advisories

• CVE-2026-64665 — high · Packagist/statamic/cms
• CVE-2026-71434 — medium · Packagist/statamic/cms
• CVE-2026-64662 — medium · Packagist/statamic/cms
• CVE-2026-64663 — medium · Packagist/statamic/cms
• CVE-2026-64664 — medium · Packagist/statamic/cms
• GHSA-cg2g-xh64-v4q7 — critical · npm/dompurify
• CVE-2026-102989 — critical · npm/@tanstack/start-server-core
• CVE-2026-104252 — critical · Go/vitess.io/vitess

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity