CVE-2026-71434: 
PHP vulnerability analysis and mitigation

CVE-2026-71434 is a file upload restriction bypass vulnerability in Statamic CMS, a Laravel and Git-powered content management system. Public frontend forms failed to enforce the same file upload restrictions configured in the Control Panel, allowing unauthenticated visitors to upload disallowed file types via assets or files form fields. Affected versions are all releases prior to 5.74.3 and 6.0.0 through 6.24.1. The vulnerability was disclosed on August 6, 2026, with patches released on July 8, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): the FrontendFormRequest class in src/Http/Requests/FrontendFormRequest.php only applied upload validation rules to assets fieldtypes and did not extend those rules to files fieldtypes, nor did it enforce asset container-level validation rules (e.g., allowed extensions configured per container) for assets fields. The fix, merged in PR #14958, updated the extraRules() method to filter both assets and files fieldtypes and added a new assetContainerRules() method that retrieves and applies the configured container's validation rules (GitHub PR, GitHub Commit). No authentication is required to exploit this vulnerability, as it targets publicly accessible frontend form submission endpoints. Statamic's global upload allowlist remained in effect, blocking the most dangerous executable types such as .php and .html (GitHub Advisory).

Successful exploitation allows unauthenticated attackers to upload file types that administrators explicitly intended to block, bypassing access control policies. For assets fields, uploaded files may be stored on a public, web-accessible disk, making them directly retrievable via URL. The primary impact is an integrity compromise — unauthorized content can be stored on the server — though confidentiality and availability are not directly affected. The global allowlist mitigates the most severe outcomes (e.g., remote code execution via .php upload), but non-executable but potentially harmful file types (e.g., .svg, .js, .xml) could still be uploaded and served publicly (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.0024 (0.24%), indicating a low probability of exploitation in the near term. The vulnerability is automatable (no user interaction or authentication required) but has no known threat actor attribution or CISA KEV catalog listing. NVD SSVC data classifies exploitation status as "none" at time of publication (GitHub Advisory).

1. Reconnaissance: Identify Statamic CMS instances running versions prior to 5.74.3 or 6.0.0–6.24.1 that expose public frontend forms with assets or files fieldtypes. This can be done via web crawling or CMS fingerprinting.
2. Identify target form endpoint: Locate a publicly accessible Statamic form submission endpoint (e.g., /!/forms/<form-handle>) that includes an assets or files field.
3. Craft malicious upload request: Prepare a multipart HTTP POST request to the form endpoint, attaching a file with a disallowed extension (e.g., .svg, .js, or another type blocked by the administrator's container configuration but not by Statamic's global allowlist).
4. Submit the request: Send the POST request without any authentication. The frontend form handler will accept the file because it does not enforce the asset container's extension restrictions or the files fieldtype's allowed extension configuration.
5. Access uploaded file: If the target field uses an assets fieldtype backed by a public disk, retrieve the uploaded file directly via its public URL, potentially using it for phishing, malware distribution, or content injection (GitHub Advisory, GitHub PR).

• Network: Unexpected multipart POST requests to /!/forms/<form-handle> endpoints containing file uploads with extensions not matching the site's intended policy (e.g., .svg, .js, .xml, .csv).
• File System: Presence of unexpected file types in asset storage directories (e.g., storage/app/public/ or configured asset container disks) that do not match the administrator's allowed extension list.
• Logs: Laravel/Statamic application logs showing successful form submissions with file uploads from unauthenticated users; web server access logs with POST requests to form endpoints accompanied by large request bodies indicative of file uploads.
• Web-Accessible Storage: Publicly reachable files in asset directories with extensions that should have been blocked per the Control Panel's asset container configuration (GitHub Advisory).

Statamic has released patched versions 5.74.3 and 6.24.2, both published on July 8, 2026. Administrators should upgrade to one of these versions immediately using Composer (composer update statamic/cms). No official configuration-based workaround is documented; upgrading is the recommended and only reliable remediation. As an interim measure, administrators can review and restrict public-facing forms to remove assets and files fieldtypes until the upgrade is applied (v5.74.3 Release, v6.24.2 Release).