Remote Code Execution (RCE) Affecting statamic/cms package, versions <3.4.14 >=4.0.0, <4.34.0
Threat Intelligence
EPSS
0.06% (24th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-STATAMICCMS-6057586
- published 15 Nov 2023
- disclosed 14 Nov 2023
- credit ahinkle
Introduced: 14 Nov 2023
CVE-2023-48217 Open this link in a new tabHow to fix?
Upgrade statamic/cms to version 3.4.14, 4.34.0 or higher.
Overview
Affected versions of this package are vulnerable to Remote Code Execution (RCE) via the 'Forms' feature and asset upload fields in the control panel. An attacker can execute arbitrary code by uploading PHP files disguised as images, bypassing mime type validation rules. This is only exploitable if the attacker has access to front-end forms or the control panel.
CVSS Scores
version 3.1