Statamic CMS remote code execution via front-end form uploads
The advisory, in context
Impact
On front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded regardless of mime validation rules. This only affects forms using the "Forms" feature and not just any arbitrary form. This does not affect the control panel.
Patches
It has been patched in 3.4.13 and 4.33.0.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 4.0.0 before 4.33.0
Fixed in 4.33.0
45 explicitly affected versions
v4.0.0, v4.1.0, v4.1.1, v4.1.2, v4.1.3, v4.10.0, v4.10.1, v4.10.2, v4.11.0, v4.12.0, v4.13.0, v4.13.1, v4.13.2, v4.14.0, v4.15.0, v4.16.0, v4.17.0, v4.18.0, v4.19.0, v4.2.0, v4.20.0, v4.21.0, v4.22.0, v4.23.0, v4.23.1, v4.23.2, v4.24.0, v4.25.0, v4.26.0, v4.26.1, v4.27.0, v4.28.0, v4.29.0, v4.3.0, v4.30.0, v4.31.0, v4.32.0, v4.4.0, v4.5.0, v4.6.0, v4.7.0, v4.8.0, v4.9.0, v4.9.1, v4.9.2
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.33.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v4.0.0",
"v4.1.0",
"v4.1.1",
"v4.1.2",
"v4.1.3",
"v4.10.0",
"v4.10.1",
"v4.10.2",
"v4.11.0",
"v4.12.0",
"v4.13.0",
"v4.13.1",
"v4.13.2",
"v4.14.0",
"v4.15.0",
"v4.16.0",
"v4.17.0",
"v4.18.0",
"v4.19.0",
"v4.2.0",
"v4.20.0",
"v4.21.0",
"v4.22.0",
"v4.23.0",
"v4.23.1",
"v4.23.2",
"v4.24.0",
"v4.25.0",
"v4.26.0",
"v4.26.1",
"v4.27.0",
"v4.28.0",
"v4.29.0",
"v4.3.0",
"v4.30.0",
"v4.31.0",
"v4.32.0",
"v4.4.0",
"v4.5.0",
"v4.6.0",
"v4.7.0",
"v4.8.0",
"v4.9.0",
"v4.9.1",
"v4.9.2"
]
}Earlier releases before 3.4.13
Fixed in 3.4.13
271 explicitly affected versions
v3.0.0, v3.0.0-beta.1, v3.0.0-beta.10, v3.0.0-beta.11, v3.0.0-beta.12, v3.0.0-beta.13, v3.0.0-beta.14, v3.0.0-beta.15, v3.0.0-beta.16, v3.0.0-beta.17, v3.0.0-beta.18, v3.0.0-beta.19, v3.0.0-beta.2, v3.0.0-beta.20, v3.0.0-beta.21, v3.0.0-beta.22, v3.0.0-beta.23, v3.0.0-beta.24, v3.0.0-beta.25, v3.0.0-beta.26, v3.0.0-beta.27, v3.0.0-beta.28, v3.0.0-beta.29, v3.0.0-beta.3, v3.0.0-beta.30, v3.0.0-beta.31, v3.0.0-beta.32, v3.0.0-beta.33, v3.0.0-beta.34, v3.0.0-beta.35, v3.0.0-beta.36, v3.0.0-beta.37, v3.0.0-beta.38, v3.0.0-beta.39, v3.0.0-beta.4, v3.0.0-beta.40, v3.0.0-beta.41, v3.0.0-beta.42, v3.0.0-beta.43, v3.0.0-beta.44, v3.0.0-beta.45, v3.0.0-beta.46, v3.0.0-beta.5, v3.0.0-beta.6, v3.0.0-beta.7, v3.0.0-beta.8, v3.0.0-beta.9, v3.0.1, v3.0.10, v3.0.11, v3.0.12, v3.0.13, v3.0.14, v3.0.15, v3.0.16, v3.0.17, v3.0.18, v3.0.19, v3.0.2, v3.0.20, v3.0.21, v3.0.22, v3.0.23, v3.0.24, v3.0.25, v3.0.26, v3.0.27, v3.0.28, v3.0.29, v3.0.3, v3.0.30, v3.0.31, v3.0.32, v3.0.33, v3.0.34, v3.0.35, v3.0.35.1, v3.0.36, v3.0.36.1, v3.0.37, v3.0.38, v3.0.39, v3.0.4, v3.0.40, v3.0.41, v3.0.42, v3.0.43, v3.0.44, v3.0.45, v3.0.46, v3.0.47, v3.0.48, v3.0.49, v3.0.5, v3.0.6, v3.0.7, v3.0.8, v3.0.9, v3.1.0, v3.1.0-alpha.1, v3.1.0-alpha.2, v3.1.0-alpha.3, v3.1.0-alpha.4, v3.1.0-beta.1, v3.1.0-beta.2, v3.1.0-beta.3, v3.1.1, v3.1.10, v3.1.11, v3.1.12, v3.1.13, v3.1.14, v3.1.15, v3.1.16, v3.1.17, v3.1.18, v3.1.19, v3.1.2, v3.1.20, v3.1.21, v3.1.22, v3.1.23, v3.1.24, v3.1.25, v3.1.26, v3.1.27, v3.1.28, v3.1.29, v3.1.3, v3.1.30, v3.1.31, v3.1.32, v3.1.33, v3.1.34, v3.1.35, v3.1.4, v3.1.5, v3.1.6, v3.1.7, v3.1.8, v3.1.9, v3.2.0, v3.2.0-beta.1, v3.2.1, v3.2.10, v3.2.11, v3.2.12, v3.2.13, v3.2.14, v3.2.15, v3.2.16, v3.2.17, v3.2.18, v3.2.19, v3.2.2, v3.2.20, v3.2.21, v3.2.22, v3.2.23, v3.2.24, v3.2.25, v3.2.26, v3.2.27, v3.2.28, v3.2.29, v3.2.3, v3.2.30, v3.2.31, v3.2.32, v3.2.33, v3.2.34, v3.2.35, v3.2.36, v3.2.37, v3.2.38, v3.2.39, v3.2.4, v3.2.5, v3.2.6, v3.2.7, v3.2.8, v3.2.9, v3.3.0, v3.3.0-beta.1, v3.3.0-beta.2, v3.3.0-beta.3, v3.3.0-beta.4, v3.3.0-beta.5, v3.3.0-beta.6, v3.3.0-beta.7, v3.3.1, v3.3.10, v3.3.11, v3.3.12, v3.3.13, v3.3.14, v3.3.15, v3.3.16, v3.3.17, v3.3.18, v3.3.19, v3.3.2, v3.3.20, v3.3.21, v3.3.22, v3.3.23, v3.3.24, v3.3.25, v3.3.26, v3.3.27, v3.3.28, v3.3.29, v3.3.3, v3.3.30, v3.3.31, v3.3.32, v3.3.33, v3.3.34, v3.3.35, v3.3.36, v3.3.37, v3.3.38, v3.3.39, v3.3.4, v3.3.40, v3.3.41, v3.3.42, v3.3.43, v3.3.44, v3.3.45, v3.3.46, v3.3.47, v3.3.48, v3.3.49, v3.3.5, v3.3.50, v3.3.51, v3.3.52, v3.3.53, v3.3.54, v3.3.55, v3.3.56, v3.3.57, v3.3.58, v3.3.59, v3.3.6, v3.3.60, v3.3.61, v3.3.62, v3.3.63, v3.3.64, v3.3.65, v3.3.66, v3.3.67, v3.3.68, v3.3.7, v3.3.8, v3.3.9, v3.4.0, v3.4.1, v3.4.10, v3.4.11, v3.4.12, v3.4.2, v3.4.3, v3.4.4, v3.4.5, v3.4.6, v3.4.7, v3.4.8, v3.4.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.4.13"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v3.0.0",
"v3.0.0-beta.1",
"v3.0.0-beta.10",
"v3.0.0-beta.11",
"v3.0.0-beta.12",
"v3.0.0-beta.13",
"v3.0.0-beta.14",
"v3.0.0-beta.15",
"v3.0.0-beta.16",
"v3.0.0-beta.17",
"v3.0.0-beta.18",
"v3.0.0-beta.19",
"v3.0.0-beta.2",
"v3.0.0-beta.20",
"v3.0.0-beta.21",
"v3.0.0-beta.22",
"v3.0.0-beta.23",
"v3.0.0-beta.24",
"v3.0.0-beta.25",
"v3.0.0-beta.26",
"v3.0.0-beta.27",
"v3.0.0-beta.28",
"v3.0.0-beta.29",
"v3.0.0-beta.3",
"v3.0.0-beta.30",
"v3.0.0-beta.31",
"v3.0.0-beta.32",
"v3.0.0-beta.33",
"v3.0.0-beta.34",
"v3.0.0-beta.35",
"v3.0.0-beta.36",
"v3.0.0-beta.37",
"v3.0.0-beta.38",
"v3.0.0-beta.39",
"v3.0.0-beta.4",
"v3.0.0-beta.40",
"v3.0.0-beta.41",
"v3.0.0-beta.42",
"v3.0.0-beta.43",
"v3.0.0-beta.44",
"v3.0.0-beta.45",
"v3.0.0-beta.46",
"v3.0.0-beta.5",
"v3.0.0-beta.6",
"v3.0.0-beta.7",
"v3.0.0-beta.8",
"v3.0.0-beta.9",
"v3.0.1",
"v3.0.10",
"v3.0.11",
"v3.0.12",
"v3.0.13",
"v3.0.14",
"v3.0.15",
"v3.0.16",
"v3.0.17",
"v3.0.18",
"v3.0.19",
"v3.0.2",
"v3.0.20",
"v3.0.21",
"v3.0.22",
"v3.0.23",
"v3.0.24",
"v3.0.25",
"v3.0.26",
"v3.0.27",
"v3.0.28",
"v3.0.29",
"v3.0.3",
"v3.0.30",
"v3.0.31",
"v3.0.32",
"v3.0.33",
"v3.0.34",
"v3.0.35",
"v3.0.35.1",
"v3.0.36",
"v3.0.36.1",
"v3.0.37",
"v3.0.38",
"v3.0.39",
"v3.0.4",
"v3.0.40",
"v3.0.41",
"v3.0.42",
"v3.0.43",
"v3.0.44",
"v3.0.45",
"v3.0.46",
"v3.0.47",
"v3.0.48",
"v3.0.49",
"v3.0.5",
"v3.0.6",
"v3.0.7",
"v3.0.8",
"v3.0.9",
"v3.1.0",
"v3.1.0-alpha.1",
"v3.1.0-alpha.2",
"v3.1.0-alpha.3",
"v3.1.0-alpha.4",
"v3.1.0-beta.1",
"v3.1.0-beta.2",
"v3.1.0-beta.3",
"v3.1.1",
"v3.1.10",
"v3.1.11",
"v3.1.12",
"v3.1.13",
"v3.1.14",
"v3.1.15",
"v3.1.16",
"v3.1.17",
"v3.1.18",
"v3.1.19",
"v3.1.2",
"v3.1.20",
"v3.1.21",
"v3.1.22",
"v3.1.23",
"v3.1.24",
"v3.1.25",
"v3.1.26",
"v3.1.27",
"v3.1.28",
"v3.1.29",
"v3.1.3",
"v3.1.30",
"v3.1.31",
"v3.1.32",
"v3.1.33",
"v3.1.34",
"v3.1.35",
"v3.1.4",
"v3.1.5",
"v3.1.6",
"v3.1.7",
"v3.1.8",
"v3.1.9",
"v3.2.0",
"v3.2.0-beta.1",
"v3.2.1",
"v3.2.10",
"v3.2.11",
"v3.2.12",
"v3.2.13",
"v3.2.14",
"v3.2.15",
"v3.2.16",
"v3.2.17",
"v3.2.18",
"v3.2.19",
"v3.2.2",
"v3.2.20",
"v3.2.21",
"v3.2.22",
"v3.2.23",
"v3.2.24",
"v3.2.25",
"v3.2.26",
"v3.2.27",
"v3.2.28",
"v3.2.29",
"v3.2.3",
"v3.2.30",
"v3.2.31",
"v3.2.32",
"v3.2.33",
"v3.2.34",
"v3.2.35",
"v3.2.36",
"v3.2.37",
"v3.2.38",
"v3.2.39",
"v3.2.4",
"v3.2.5",
"v3.2.6",
"v3.2.7",
"v3.2.8",
"v3.2.9",
"v3.3.0",
"v3.3.0-beta.1",
"v3.3.0-beta.2",
"v3.3.0-beta.3",
"v3.3.0-beta.4",
"v3.3.0-beta.5",
"v3.3.0-beta.6",
"v3.3.0-beta.7",
"v3.3.1",
"v3.3.10",
"v3.3.11",
"v3.3.12",
"v3.3.13",
"v3.3.14",
"v3.3.15",
"v3.3.16",
"v3.3.17",
"v3.3.18",
"v3.3.19",
"v3.3.2",
"v3.3.20",
"v3.3.21",
"v3.3.22",
"v3.3.23",
"v3.3.24",
"v3.3.25",
"v3.3.26",
"v3.3.27",
"v3.3.28",
"v3.3.29",
"v3.3.3",
"v3.3.30",
"v3.3.31",
"v3.3.32",
"v3.3.33",
"v3.3.34",
"v3.3.35",
"v3.3.36",
"v3.3.37",
"v3.3.38",
"v3.3.39",
"v3.3.4",
"v3.3.40",
"v3.3.41",
"v3.3.42",
"v3.3.43",
"v3.3.44",
"v3.3.45",
"v3.3.46",
"v3.3.47",
"v3.3.48",
"v3.3.49",
"v3.3.5",
"v3.3.50",
"v3.3.51",
"v3.3.52",
"v3.3.53",
"v3.3.54",
"v3.3.55",
"v3.3.56",
"v3.3.57",
"v3.3.58",
"v3.3.59",
"v3.3.6",
"v3.3.60",
"v3.3.61",
"v3.3.62",
"v3.3.63",
"v3.3.64",
"v3.3.65",
"v3.3.66",
"v3.3.67",
"v3.3.68",
"v3.3.7",
"v3.3.8",
"v3.3.9",
"v3.4.0",
"v3.4.1",
"v3.4.10",
"v3.4.11",
"v3.4.12",
"v3.4.2",
"v3.4.3",
"v3.4.4",
"v3.4.5",
"v3.4.6",
"v3.4.7",
"v3.4.8",
"v3.4.9"
]
}References
- https://github.com/statamic/cms/security/advisories/GHSA-72hg-5wr5-rmfc
- https://nvd.nist.gov/vuln/detail/CVE-2023-47129
- https://github.com/statamic/cms/commit/098ef8024d97286ca501273c18ae75b646262d75
- https://github.com/statamic/cms/commit/f6c688154f6bdbd0b67039f8f11dcd98ba061e77
- https://github.com/statamic/cms