https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-23T06:02:19.171626+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-205671 EUVD-2026-205671 2026-10-23T06:02:19.219125+00:00 EUVD-2026-205671 https://cve.radiocsirt.org/vuln/fkie_cve-2024-52600 fkie_cve-2024-52600 2026-10-23T06:02:19.219161+00:00

Statmatic is a Laravel and Git powered content management system (CMS). Prior to version 5.17.0, assets uploaded with appropriately crafted filenames may result in them being placed in a location different than what was configured. The issue affects front-end forms with `assets` fields and other places where assets can be uploaded, although users would need upload permissions anyway. Files can be uploaded so they would be located on the server in a different location, and potentially override existing files. Traversal outside an asset container is not possible. This path traversal vulnerability has been fixed in 5.17.0.

 https://cve.radiocsirt.org/vuln/ghsa-p7f6-8mcm-fwv3 GHSA-p7f6-8mcm-fwv3 — Statamic CMS has a Path Traversal in Asset Upload 2026-10-23T06:02:19.219196+00:00

Affected: Packagist: statamic/cms

Assets uploaded with appropriately crafted filenames may result in them being placed in a location different than what was configured.

### Impact

- Affects front-end forms with `assets` fields. - Affects other places where assets can be uploaded, although users would need upload permissions anyway. - Files can be uploaded so they would be located on the server in a different location, and potentially override existing files. - Traversal _outside_ an asset container was not possible.

### Patches

This has been fixed in 5.17.0.