CVE-2026-71435
Published: Thu, 06 Aug 2026 22:18
Summary
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, the default ("automagic") form notification email rendered user-submitted values without escaping, al
Details
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, the default ("automagic") form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the configured recipients. This issue is fixed in versions 5.74.3 and 6.24.2.
Are YOU affected by CVE-2026-71435?
5-second check on your actual server. Reads /etc/os-release, uname -r, and dpkg-query; matches against the live USN + Debian Security Tracker feeds; tells you whether CVE-2026-71435 (and any other live CVE) applies. Anonymous, no signup.
curl https://mindsparkstack.com/scan.sh | bash
References
- https://github.com/statamic/cms/commit/4ad1335e818a67249d0617f0f167a1198fb96a2c
- https://github.com/statamic/cms/pull/14959
- https://github.com/statamic/cms/releases/tag/v5.74.3
- https://github.com/statamic/cms/releases/tag/v6.24.2
- https://github.com/statamic/cms/security/advisories/GHSA-vx89-p3j7-8xqc
StackPatch runs this match against YOUR installed packages every hour
Free (3 servers) / from $9/mo (14-day free trial) / Solo $9/mo / Pro $29/mo / Team $79/mo. Indie pricing.