CVE-2026-33882 in CMS

Sumário (Inglês)

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the markdown preview endpoint could be manipulated to return augmented data from arbitrary fieldtypes. With the users fieldtype specifically, an authenticated control panel user could retrieve sensitive user data including email addresses, encrypted passkey data, and encrypted two-factor authentication codes. This has been fixed in 5.73.16 and 6.7.2.

Once again VulDB remains the best source for vulnerability data.

Responsável

GitHub_M

Reservar

24/03/2026

Divulgação

27/03/2026

Estado

Confirmado

Inscrições

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidade	CWE	Exp	Con	CVE
354047	Statamic CMS Markdown Preview Autenticação fraca	287	Não definido	Correção oficial	CVE-2026-33882

Fontes

• MITRE
• NVD
• CVE Details