https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-21T12:07:07.955397+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-161110 EUVD-2026-161110 2026-10-21T12:07:07.958239+00:00 EUVD-2026-161110 https://cve.radiocsirt.org/vuln/fkie_cve-2023-47129 fkie_cve-2023-47129 2026-10-21T12:07:07.958280+00:00

Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded. This only affects forms using the "Forms" feature and not just _any_ arbitrary form. This does not affect the control panel. This issue has been patched in 3.4.13 and 4.33.0.

 https://cve.radiocsirt.org/vuln/ghsa-72hg-5wr5-rmfc GHSA-72hg-5wr5-rmfc — Statamic CMS remote code execution via front-end form uploads 2026-10-21T12:07:07.958322+00:00

Affected: Packagist: statamic/cms

### Impact On front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded regardless of mime validation rules. This only affects forms using the "Forms" feature and not just _any_ arbitrary form. This does not affect the control panel.

### Patches It has been patched in 3.4.13 and 4.33.0.

 https://cve.radiocsirt.org/vuln/gsd-2023-47129 gsd-2023-47129 2026-10-21T12:07:07.958358+00:00 gsd-2023-47129