CVE-2026-33885

MEDIUM

Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential

Title source: cna

Description

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the external URL detection used for redirect validation on unauthenticated endpoints could be bypassed, allowing users to be redirected to external URLs after actions like form submissions and authentication flows. This has been fixed in 5.73.16 and 6.7.2.

References (1)

[X_Refsource_Confirm] https://github.com/statamic/cms/security/advisories/GHSA-7f74-7q5w-hj4r

Scores

CVSS v3 6.1

EPSS 0.0005

EPSS Percentile 14.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-601

Status published

Products (4)

statamic/cms 0 - 5.73.16Packagist

statamic/cms < 5.73.16

statamic/cms >= 6.0.0.alpha.1, < 6.7.2

statamic/statamic < 5.73.16

Published Mar 27, 2026

Tracked Since Mar 29, 2026