CVE-2023-47129 Statamic CMS remote code execution via front-end form uploads

What is CVE-2023-47129?

CVE-2023-47129 is a high-severity vulnerability in statamic cms, published on 10 Nov 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded. This only affects forms using the "Forms" feature and not just _any_ arbitrary form. This does not affect the control panel. This issue has been patched in 3.4.13 and 4.33.0.

Weakness: CWE-434

Which versions are affected by CVE-2023-47129?

4 open source packages ship an affected version, including statamic/cms. It affects 1 product.

Products include Statamic Statamic.

How do I fix CVE-2023-47129?

Upgrade statamic/cms to a fixed version for your release line: 3.4.13 or 4.33.0.

Is CVE-2023-47129 being exploited?

There is no known exploitation of CVE-2023-47129 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in statamic cms

• CVE-2021-45364 Code injection in n/a Critical 9.8
• CVE-2026-27593 Statamic is vulnerable to account takeover via password reset link injection Critical 9.3
• CVE-2026-27939 Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass High 8.8
• CVE-2023-48217 Remote code execution via form uploads in statamic/cms High 8.8
• CVE-2017-11422 Statamic framework Incorrect Permission Assignment High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-72hg-5wr5-rmfc.