CVE-2026-71435 in Statamic
Summary
by MITRE • 08/07/2026
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, the default ("automagic") form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the configured recipients. This issue is fixed in versions 5.74.3 and 6.24.2.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/07/2026
This vulnerability affects Statamic CMS versions prior to 5.74.3 and 6.24.2, where form notification emails are generated using user-submitted data without proper HTML escaping mechanisms. The flaw exists in the default form handling behavior that automatically processes and includes user input directly into email templates without sanitizing potentially malicious content. This represents a classic cross-site scripting vulnerability that occurs at the email rendering layer rather than in web application interfaces, making it particularly insidious as it can affect administrators and recipients who are not directly interacting with the CMS frontend.
The technical implementation of this vulnerability stems from improper output encoding practices within the email template generation system. When form submissions are processed, the CMS automatically includes submitted field values into notification emails, but fails to escape HTML special characters such as angle brackets, quotes, and ampersands that could be used to inject malicious markup. This allows an attacker who can submit forms to include HTML tags in their input fields, which then get rendered in the email notifications sent to administrators or other configured recipients. The vulnerability specifically aligns with CWE-79 - Cross-site Scripting and follows patterns commonly found in template injection flaws where user data is directly embedded into output contexts without proper sanitization.
The operational impact of this vulnerability extends beyond simple visual disruption, as it can enable several attack vectors including phishing attempts, credential theft through malicious links, or even browser-based attacks if recipients open the emails in vulnerable email clients. An attacker could craft submissions that include JavaScript code within email notifications, potentially leading to unauthorized access to administrative accounts or data exfiltration. The vulnerability affects any administrator or recipient who receives these form notifications, and since the issue occurs at the default configuration level, it impacts all installations without requiring specific user interaction beyond submitting a malicious form.
The security implications of this vulnerability are significant because it undermines the trust model between CMS administrators and their email communication systems. Email notifications that should contain only legitimate user data become potential attack vectors for social engineering campaigns or automated exploitation attempts. The fix implemented in versions 5.74.3 and 6.24.2 addresses this by introducing proper HTML escaping mechanisms within the email template rendering process, ensuring that any user-submitted content is sanitized before inclusion in notification emails. This remediation aligns with established security practices for preventing XSS vulnerabilities in email contexts and follows ATT&CK techniques related to initial access through phishing or credential theft via malicious email content.
Organizations should immediately upgrade to the patched versions of Statamic to prevent exploitation, while administrators should review their form configurations to ensure that no custom notification templates bypass the default sanitization mechanisms. The vulnerability highlights the importance of input validation and output encoding practices in all user-facing data processing contexts, particularly within email generation systems where the attack surface can extend beyond direct application users to include system administrators and other stakeholders who may be exposed to malicious content through automated notifications.