CVE-2026-28425

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, an authenticated control panel user with access to Antlers-enabled inputs may be able to achieve remote code execution in the application context. That can lead to full compromise of the application, including access to sensitive configuration, modification or exfiltration of data, and potential impact on availability. Exploitation is only possible where Antlers runs on user-controlled content—for example, content fields with Antlers explicitly enabled (requiring permission to configure fields and to edit entries), built-in config that supports Antlers such as Forms email notification settings (requiring configuration permission), or third-party addons that add Antlers-enabled fields to entries (for example, the SEO Pro addon). In each case the attacker must have the relevant control panel permissions. This has been fixed in 5.73.16 and 6.7.2. Users of addons that depend on Statamic should ensure that after updating they are running a patched Statamic version.

• CWE-94

• https://github.com/statamic/cms/releases/tag/v5.73.11Release Notes
• https://github.com/statamic/cms/releases/tag/v6.4.0Release Notes
• https://github.com/statamic/cms/security/advisories/GHSA-cpv7-q2wx-m8rwPatch, Vendor Advisory

Published

Feb 27, 2026

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2842Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-28420Vim is an open source, command line text editor. Prior to ve…4.4
• CVE-2026-28421Vim is an open source, command line text editor. Versions pr…7.8
• CVE-2026-28422Vim is an open source, command line text editor. Prior to ve…2.2
• CVE-2026-28423Statmatic is a Laravel and Git powered content management sy…8.6
• CVE-2026-28424Statmatic is a Laravel and Git powered content management sy…6.5
• CVE-2026-28426Statmatic is a Laravel and Git powered content management sy…5.4
• CVE-2026-28427OpenDeck is Linux software for your Elgato Stream Deck. Prio…7.5
• CVE-2026-28428Talishar is a fan-made Flesh and Blood project. Prior to com…5.3
• CVE-2026-28429Talishar is a fan-made Flesh and Blood project. Prior to com…7.5
• CVE-2026-28430Chamilo LMS is a learning management system. Prior to versio…9.8
• CVE-2026-28431Misskey is an open source, federated social media platform. …7.5