CVE-2023-48217

    Dashboard / Vulnerabilities / CVE-2023-48217

    CVE-2023-48217

    Published: 14 Nov 2023Last Modified: 28 Oct 2026

    Summary: Remote code execution via form uploads in statamic/cms

    Details: Statamic is a flat-first, Laravel + Git powered CMS designed for building websites. In affected versions certain additional PHP files crafted to look like images may be uploaded regardless of mime type validation rules. This affects front-end forms using the "Forms" feature, and asset upload fields in the control panel. Malicious users could leverage this vulnerability to upload and execute code. This issue has been patched in versions 3.4.14 and 4.34.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48217.json, https://github.com/statamic/cms/security/advisories/GHSA-2r53-9295-3m86, https://nvd.nist.gov/vuln/detail/CVE-2023-48217, https://github.com/statamic/cms/commit/4c6fe041e2203a8033e5949ce4a5d9d6c0ad2411

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -8a808780b0756b18c921a55f53e97768c877f9c6

    Affected versions

    v3.4.13
    v3.4.12
    v3.4.11
    v3.4.10
    v3.4.9
    v3.4.8
    v3.4.7
    v3.4.6
    v3.4.5
    v3.4.4
    v3.4.3
    v3.4.2
    v3.4.1
    v3.4.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-48217 | CVE-DB