CVE-2026-71435

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71435", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-06T16:28:51.183Z", "datePublished": "2026-08-06T19:37:54.834Z", "dateUpdated": "2026-08-08T02:31:25.913Z"}, "containers": {"cna": {"title": "Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/statamic/cms/security/advisories/GHSA-vx89-p3j7-8xqc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/statamic/cms/security/advisories/GHSA-vx89-p3j7-8xqc"}, {"name": "https://github.com/statamic/cms/pull/14959", "tags": ["x_refsource_MISC"], "url": "https://github.com/statamic/cms/pull/14959"}, {"name": "https://github.com/statamic/cms/commit/4ad1335e818a67249d0617f0f167a1198fb96a2c", "tags": ["x_refsource_MISC"], "url": "https://github.com/statamic/cms/commit/4ad1335e818a67249d0617f0f167a1198fb96a2c"}, {"name": "https://github.com/statamic/cms/releases/tag/v5.74.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/statamic/cms/releases/tag/v5.74.3"}, {"name": "https://github.com/statamic/cms/releases/tag/v6.24.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/statamic/cms/releases/tag/v6.24.2"}], "affected": [{"vendor": "statamic", "product": "cms", "versions": [{"version": "< 5.74.3", "status": "affected"}, {"version": ">= 6.0.0, < 6.24.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-06T19:37:54.834Z"}, "descriptions": [{"lang": "en", "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, the default (\"automagic\") form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the configured recipients. This issue is fixed in versions 5.74.3 and 6.24.2."}], "source": {"advisory": "GHSA-vx89-p3j7-8xqc", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-08T02:31:13.526218Z", "id": "CVE-2026-71435", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-08T02:31:25.913Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71435", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-08T02:31:13.526218Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-08T02:31:19.854Z"}}], "cna": {"title": "Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template", "source": {"advisory": "GHSA-vx89-p3j7-8xqc", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "statamic", "product": "cms", "versions": [{"status": "affected", "version": "< 5.74.3"}, {"status": "affected", "version": ">= 6.0.0, < 6.24.2"}]}], "references": [{"url": "https://github.com/statamic/cms/security/advisories/GHSA-vx89-p3j7-8xqc", "name": "https://github.com/statamic/cms/security/advisories/GHSA-vx89-p3j7-8xqc", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/statamic/cms/pull/14959", "name": "https://github.com/statamic/cms/pull/14959", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/statamic/cms/commit/4ad1335e818a67249d0617f0f167a1198fb96a2c", "name": "https://github.com/statamic/cms/commit/4ad1335e818a67249d0617f0f167a1198fb96a2c", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/statamic/cms/releases/tag/v5.74.3", "name": "https://github.com/statamic/cms/releases/tag/v5.74.3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/statamic/cms/releases/tag/v6.24.2", "name": "https://github.com/statamic/cms/releases/tag/v6.24.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, the default (\"automagic\") form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the configured recipients. This issue is fixed in versions 5.74.3 and 6.24.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-06T19:37:54.834Z"}}}, "cveMetadata": {"cveId": "CVE-2026-71435", "state": "PUBLISHED", "dateUpdated": "2026-08-08T02:31:25.913Z", "dateReserved": "2026-08-06T16:28:51.183Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-06T19:37:54.834Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "cms", "vendor": "statamic", "versions": [{"status": "affected", "version": "< 5.74.3"}, {"status": "affected", "version": ">= 6.0.0, < 6.24.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, the default (\"automagic\") form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the configured recipients. This issue is fixed in versions 5.74.3 and 6.24.2."}, {"lang": "es", "value": "Statamic es un sistema de gesti\u00f3n de contenido (CMS) impulsado por Laravel y Git. Antes de 5.74.3 y 6.24.2, el correo electr\u00f3nico de notificaci\u00f3n de formulario predeterminado (\u2019autom\u00e1gico\u2019) renderizaba los valores enviados por el usuario sin escapar, permitiendo que un remitente de formulario no autenticado inyectara HTML en los correos electr\u00f3nicos de notificaci\u00f3n enviados a los destinatarios configurados. Este problema est\u00e1 solucionado en las versiones 5.74.3 y 6.24.2."}], "id": "CVE-2026-71435", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71435", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-08T02:31:13.526218Z", "version": "2.0.3"}}]}, "published": "2026-08-06T22:18:30.423", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/statamic/cms/commit/4ad1335e818a67249d0617f0f167a1198fb96a2c"}, {"source": "security-advisories@github.com", "url": "https://github.com/statamic/cms/pull/14959"}, {"source": "security-advisories@github.com", "url": "https://github.com/statamic/cms/releases/tag/v5.74.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/statamic/cms/releases/tag/v6.24.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/statamic/cms/security/advisories/GHSA-vx89-p3j7-8xqc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.74.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.0.0,6.24.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "cms", "source": "cna", "vendor": "statamic"}, "product": "cms", "vendor": "statamic"}], "created": "2026-08-07T01:00:05.869986+00:00", "updated": "2026-08-07T01:45:05.154303+00:00", "vendors": ["statamic", "statamic$PRODUCT$cms"]}