CVE-2026-33171 Statamic has a path traversal in file dictionary fieldtype

What is CVE-2026-33171?

CVE-2026-33171 is a medium-severity path traversal vulnerability in statamic cms, published on 20 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, authenticated Control Panel users could read arbitrary `.json`, `.yaml`, and `.csv` files from the server by manipulating the file dictionary's `filename` configuration parameter in the fieldtype's endpoint. This has been fixed in 5.73.14 and 6.7.0.

Weakness: CWE-22

Which versions are affected by CVE-2026-33171?

4 open source packages ship an affected version, including statamic/cms. It affects 1 product.

Products include Statamic Statamic.

How do I fix CVE-2026-33171?

Upgrade statamic/cms to a fixed version for your release line: 5.73.14 or 6.7.0.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-33171 being exploited?

There is no known exploitation of CVE-2026-33171 in the wild and no public exploit code.

Other vulnerabilities in statamic cms

• CVE-2021-45364 Code injection in n/a Critical 9.8
• CVE-2026-27593 Statamic is vulnerable to account takeover via password reset link injection Critical 9.3
• CVE-2026-27939 Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass High 8.8
• CVE-2023-48217 Remote code execution via form uploads in statamic/cms High 8.8
• CVE-2017-11422 Statamic framework Incorrect Permission Assignment High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qm7r-wwq7-6f85.