CVE-2023-47129

    Dashboard / Vulnerabilities / CVE-2023-47129

    CVE-2023-47129

    Published: 10 Nov 2023Last Modified: 12 Aug 2026

    Summary: Statamic CMS remote code execution via front-end form uploads

    Details: Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded. This only affects forms using the "Forms" feature and not just _any_ arbitrary form. This does not affect the control panel. This issue has been patched in 3.4.13 and 4.33.0.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47129.json, https://github.com/statamic/cms/security/advisories/GHSA-72hg-5wr5-rmfc, https://nvd.nist.gov/vuln/detail/CVE-2023-47129, https://github.com/statamic/cms/commit/098ef8024d97286ca501273c18ae75b646262d75, https://github.com/statamic/cms/commit/f6c688154f6bdbd0b67039f8f11dcd98ba061e77

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -14561f3d62fbba51a66c75f269630c1f060f110a

    Affected versions

    v3.4.12
    v3.4.11
    v3.4.10
    v3.4.9
    v3.4.8
    v3.4.7
    v3.4.6
    v3.4.5
    v3.4.4
    v3.4.3
    v3.4.2
    v3.4.1
    v3.4.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-47129 | CVE-DB