CVE-2026-25633

Statamic is a, Laravel + Git powered CMS designed for building websites. Prior to 5.73.6 and 6.2.5, users without permission to view assets are able are able to download them and view their metadata. Logged-out users and users without permission to access the control panel are unable to take advantage of this. This has been fixed in 5.73.6 and 6.2.5.

• CWE-862

• https://github.com/statamic/cms/commit/5a6f47246edf3a0c453727ffecbfa14333a6bc8aPatch, Product
• https://github.com/statamic/cms/releases/tag/v5.73.6Release Notes
• https://github.com/statamic/cms/releases/tag/v6.2.5Release Notes
• https://github.com/statamic/cms/security/advisories/GHSA-gwmx-9gcj-332hVendor Advisory

Published

Feb 11, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25627NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging …7.5
• CVE-2026-25628Qdrant is a vector similarity search engine and vector datab…8.8
• CVE-2026-2563A vulnerability was identified in JingDong JD Cloud Box AX66…8.8
• CVE-2026-25630Rejected reason: Reason: This candidate was issued in error.
• CVE-2026-25631n8n is an open source workflow automation platform. Prior to…6.5
• CVE-2026-25632EPyT-Flow is a Python package designed for the easy generati…10
• CVE-2026-25634iccDEV provides a set of libraries and tools that allow for …7.8
• CVE-2026-25635calibre is an e-book manager. Prior to 9.2.0, Calibre's CHM …8.6
• CVE-2026-25636calibre is an e-book manager. In 9.1.0 and earlier, a path t…7.8
• CVE-2026-25637ImageMagick is free and open-source software used for editin…5.3
• CVE-2026-25638ImageMagick is free and open-source software used for editin…5.3
• CVE-2026-25639Axios is a promise based HTTP client for the browser and Nod…7.5