CVE-2021-45364 Code injection in n/a
A code execution vulnerability was reported in Statamic, though the vendor states the affected code was not used in any product.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-45364?
CVE-2021-45364 is a critical code injection vulnerability in n/a, published on 10 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A Code Execution vulnerability exists in Statamic Version through 3.2.26 via SettingsController.php. NOTE: the vendor indicates that there was an error in publishing this CVE Record, and that all parties agree that the affected code was not used in any Statamic product
Which versions are affected by CVE-2021-45364?
It affects 1 product.
Products include Statamic Statamic.
How do I fix CVE-2021-45364?
No fix has been published for CVE-2021-45364 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-45364 being exploited?
There is no known exploitation of CVE-2021-45364 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2026-27593 Statamic is vulnerable to account takeover via password reset link injection
- CVE-2026-27939 Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass
- CVE-2023-48217 Remote code execution via form uploads in statamic/cms
- CVE-2017-11422 Statamic framework Incorrect Permission Assignment
- CVE-2026-33172 Statamic has Stored XSS via SVG Sanitization Bypass
Sources
Also known as GHSA-hv3v-c734-65qr.