CVE-2026-25633: 
PHP vulnerability analysis and mitigation

CVE-2026-25633 is a missing authorization vulnerability in Statamic CMS's asset management system that allows authenticated low-privilege users to download assets and view their metadata without having explicit permission to do so. It affects all Statamic versions prior to 5.73.6 and versions 6.0.0 through 6.2.4. The vulnerability was disclosed and patched on February 11, 2026. It carries a CVSS v3.1 base score of 4.3 (Medium) (Github Advisory, Statamic Advisory).

The root cause is CWE-862 (Missing Authorization): asset-serving controllers in Statamic's control panel — specifically ThumbnailController, PdfController, and SvgController — did not perform authorization checks before returning asset contents to the requesting user. The fix added $this->authorize('view', $asset) calls in each affected controller, ensuring that only users with the appropriate view [container] assets permission can retrieve asset data. Exploitation requires an authenticated session with control panel access but does not require any specific asset-viewing role, making it exploitable by any low-privilege CP user (Github Advisory, Patch Commit).

Successful exploitation allows authenticated control panel users without asset-viewing permissions to download restricted files (images, PDFs, SVGs) and view their associated metadata, resulting in unauthorized disclosure of potentially sensitive content. There is no impact on integrity or availability. Logged-out users and users without any control panel access cannot exploit this vulnerability, limiting the attack surface to internal or partially trusted users (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.009% (2nd percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires a valid authenticated session with control panel access, significantly limiting the attack surface (Github Advisory, Feedly).

1. Authenticate: Log in to the Statamic control panel with any low-privilege account that has access cp permission but lacks view [container] assets permission.
2. Identify asset identifiers: Browse the control panel or infer asset container and path combinations (e.g., test::image.png), then base64-encode the identifier (e.g., base64_encode('test::image.png')).
3. Request restricted assets: Send authenticated HTTP GET requests directly to the asset-serving endpoints without the required view permission:
   • Thumbnails: GET /cp/thumbnails/<base64_encoded_asset_id>
   • PDFs: GET /cp/pdfs/<base64_encoded_asset_id>
   • SVGs: GET /cp/svgs/<base64_encoded_asset_id>
4. Retrieve asset content: On unpatched versions, the server returns the full asset content and metadata without performing an authorization check, allowing the attacker to download the file (Patch Commit, Github Advisory).

• Network: Authenticated HTTP GET requests to /cp/thumbnails/, /cp/pdfs/, or /cp/svgs/ endpoints from users whose roles do not include asset-viewing permissions; repeated requests to these endpoints with different base64-encoded asset identifiers suggesting enumeration.
• Logs: Web server or application access logs showing successful (HTTP 200) responses to the above endpoints for users without view [container] assets roles; unusual volume of asset download requests from a single low-privilege account.
• Application: Statamic audit logs (if enabled) showing asset access events from users not assigned asset-viewing permissions.

Statamic has released patched versions 5.73.6 (for the 5.x branch) and 6.2.5 (for the 6.x branch), both published on February 11, 2026. Organizations should upgrade immediately to one of these versions. No configuration-based workaround is available; the only remediation is upgrading to a patched release. As an interim measure, administrators should review control panel user roles and restrict CP access to only trusted users (Statamic Advisory, v5.73.6 Release, v6.2.5 Release).