CVE-2026-33886 Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields

What is CVE-2026-33886?

CVE-2026-33886 is a medium-severity vulnerability in statamic cms, published on 27 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Statamic is a Laravel and Git powered content management system (CMS). Starting in version 5.7.12 and prior to versions 5.73.16 and 6.7.2, a control panel user with access to Antlers-enabled fields could access sensitive application configuration values by inserting config variables into their content. This has been fixed in 5.73.16 and 6.7.2.

Weakness: CWE-200

Which versions are affected by CVE-2026-33886?

4 open source packages ship an affected version, including statamic/cms. It affects 1 product.

Products include Statamic Statamic.

How do I fix CVE-2026-33886?

Upgrade statamic/cms to a fixed version for your release line: 5.73.16 or 6.7.2.

Is CVE-2026-33886 being exploited?

There is no known exploitation of CVE-2026-33886 in the wild and no public exploit code.

Other vulnerabilities in statamic cms

• CVE-2021-45364 Code injection in n/a Critical 9.8
• CVE-2026-27593 Statamic is vulnerable to account takeover via password reset link injection Critical 9.3
• CVE-2026-27939 Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass High 8.8
• CVE-2023-48217 Remote code execution via form uploads in statamic/cms High 8.8
• CVE-2017-11422 Statamic framework Incorrect Permission Assignment High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gcqf-5x9f-hq7f.