CVE-2023-47129

Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded. This only affects forms using the "Forms" feature and not just _any_ arbitrary form. This does not affect the control panel. This issue has been patched in 3.4.13 and 4.33.0.

• CWE-434
• CWE-434

• https://github.com/statamic/cms/commit/098ef8024d97286ca501273c18ae75b646262d75Patch
• https://github.com/statamic/cms/commit/f6c688154f6bdbd0b67039f8f11dcd98ba061e77Patch
• https://github.com/statamic/cms/security/advisories/GHSA-72hg-5wr5-rmfcVendor Advisory
• https://github.com/statamic/cms/commit/098ef8024d97286ca501273c18ae75b646262d75Patch
• https://github.com/statamic/cms/commit/f6c688154f6bdbd0b67039f8f11dcd98ba061e77Patch
• https://github.com/statamic/cms/security/advisories/GHSA-72hg-5wr5-rmfcVendor Advisory

Published

Nov 10, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-47123iTop is an IT service management platform. By filling malic…5.4
• CVE-2023-47124Traefik is an open source HTTP reverse proxy and load balanc…5.9
• CVE-2023-47125TYPO3 is an open source PHP based web content management sys…6.1
• CVE-2023-47126TYPO3 is an open source PHP based web content management sys…5.3
• CVE-2023-47127TYPO3 is an open source PHP based web content management sys…5.4
• CVE-2023-47128Piccolo is an object-relational mapping and query builder wh…9.1
• CVE-2023-4713A vulnerability has been found in IBOS OA 4.5.5 and classifi…8.8
• CVE-2023-47130Yii is an open source PHP web framework. yiisoft/yii before …9.8
• CVE-2023-47131The N-able PassPortal extension before 3.29.2 for Chrome ins…7.5
• CVE-2023-47132An issue discovered in N-able N-central before 2023.6 and ea…9.8
• CVE-2023-4714A vulnerability was found in PlayTube 3.0.1 and classified a…7.5
• CVE-2023-47140IBM CICS Transaction Gateway 9.3 could allow a user to trans…8.1