How many CVEs have a located fix in statamic/cms?

20 published CVEs have a fix traced to functions in statamic/cms, touching 45 functions across 37 files.

Which function in statamic/cms has been patched by the most CVEs?

extraRules in src/Http/Controllers/FormController.php has been changed by 2 CVE fixes, from 2023 to 2023.

How large is a typical CVE fix in statamic/cms?

The median fix changes 20 lines. 55% of fixes change 20 lines or fewer, and 15% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

php

#267 of 500 repositories

statamic/cms

Name: statamic/cms: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix August 6, 2026

20

CVE fixes located

Published CVEs

45

Functions patched

Distinct function sites

37

Files patched

Distinct source files

2022–2026

Years covered

By CVE publication date

Overview

20 published CVEs have a fix traced to functions in statamic/cms, the earliest published in 2022. Those fixes changed 45 distinct functions across 37 files, in 139 patch hunks.

Among the 500 repositories tracked here, statamic/cms ranks #267 by the number of CVEs with a located fix.

Most patched functions

Functions in statamic/cms changed by the most CVE fixes.

Most patched files

Files in statamic/cms changed by the most CVE fixes.

1src/Http/Controllers/FormController.php3 CVEs · 2 functions
2src/Imaging/GuzzleAdapter.php1 CVEs · 4 functions
3src/Http/Controllers/CP/Navigation/NavigationPagesController.php1 CVEs · 3 functions
4src/Http/Controllers/ForgotPasswordController.php1 CVEs · 3 functions
5resources/js/components/command-palette/CommandPalette.vue1 CVEs · 2 functions
6src/Exceptions/Concerns/RendersControlPanelExceptions.php1 CVEs · 2 functions
7src/Http/Controllers/API/UsersController.php1 CVEs · 2 functions
8src/Http/Controllers/CP/Assets/FolderActionController.php1 CVEs · 2 functions
9src/Http/Controllers/CP/Users/UserWizardController.php1 CVEs · 2 functions
10src/Imaging/RemoteUrlValidator.php1 CVEs · 2 functions

Fix size

How much code a CVE fix in statamic/cms changes, with backports counted once.

20

Median lines changed

Added plus removed, per CVE

55%

Fixes of 20 lines or fewer

Share of CVE fixes

15%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in statamic/cms, and the functions each fix changed.

Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template
CVE-2026-71435
Medium · CVSS 6.1
EPSS 0.3%2026-08-06
Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types
CVE-2026-71434array_merge
Medium · CVSS 5.3
EPSS 0.4%2026-08-06
Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries
CVE-2026-64662create edit update
Medium · CVSS 6.5
EPSS 0.4%2026-08-06
Statamic: Account takeover via OAuth email matching without email-verification check
CVE-2026-64665trustsEmails handleProviderCallback
High · CVSS 8.1
EPSS 0.5%2026-08-06
Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence
CVE-2026-64664__invoke UserWizardController
Medium · CVSS 4.3
EPSS 0.3%2026-08-06
Statamic: CSV formula injection in form submission exports
CVE-2026-54243export
Medium · CVSS 6.1
EPSS 0.3%2026-07-17
Statamic: Server-Side Request Forgery via Glide (DNS rebinding)
CVE-2026-54242send validate get
Medium · CVSS 4.9
EPSS 0.2%2026-07-17
Statamic: Incorrect authorization lets view-only users submit Live Preview content reserved for editors
CVE-2026-54244showLivePreviewButton edit
Low · CVSS 3.5
EPSS 0.3%2026-07-17
Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass
CVE-2026-27939redirect getAuthExceptionRedirectUrl RendersControlPanelExceptions
High · CVSS 8.8
EPSS 0.5%2026-02-27
Statamic is vulnerable to account takeover via password reset link injection
CVE-2026-27593sendResetLinkEmail all ForgotPasswordController
Critical · CVSS 9.3
EPSS 0.6%2026-02-24
Statamic affected by privilege escalation via stored Cross-site Scripting
CVE-2026-27196html configFieldItems
High · CVSS 8.1
EPSS 0.4%2026-02-21
Statmatic affected by privilege escalation via stored cross-site scripting
CVE-2026-25759map highlightResult
High · CVSS 8.7
EPSS 0.5%2026-02-11

Get an alert for each new statamic/cms CVE, with the patched functions and AI-written analysis.

Monitor cms CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

DCMTK/dcmtk20 CVEs git/git20 CVEs hestiacp/hestiacp20 CVEs jgraph/drawio20 CVEs langgenius/dify20 CVEs michaelrsweet/htmldoc20 CVEs misskey-dev/misskey20 CVEs nats-io/nats-server20 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in statamic/cms.

How many CVEs have a located fix in statamic/cms?: 20 published CVEs have a fix traced to functions in statamic/cms, touching 45 functions across 37 files.
Which function in statamic/cms has been patched by the most CVEs?: extraRules in src/Http/Controllers/FormController.php has been changed by 2 CVE fixes, from 2023 to 2023.
How large is a typical CVE fix in statamic/cms?: The median fix changes 20 lines. 55% of fixes change 20 lines or fewer, and 15% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track statamic/cms CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing