Statamic CMS vulnerable to Cross-site Scripting via uploaded assets

Overview

Statamic CMS, a Laravel and Git-powered content management system, contained a vulnerability in how it validated uploaded file types. Prior to versions 3.4.15 and 4.36.0, the mime validation could be bypassed, allowing an attacker to upload HTML files that were crafted to appear as image files. This is a server-side validation weakness, not a client-side issue. [1][2]

Exploitation

The attack surface exists in two contexts: front-end forms that include an assets field via the "Forms" feature, and the authenticated control panel. For the control panel, authentication is required, limiting the attack to authenticated users. In either case, the uploaded file bypasses mime validation, so an HTML file containing JavaScript can be stored on the server. When that file is later accessed or rendered (for example, if an administrator or visitor views the uploaded file directly or via a media preview), the embedded script executes in the browser of the viewing user. This is a stored cross-site scripting (XSS) vulnerability. [2][4]

Impact

An attacker who successfully uploads a malicious HTML file can execute arbitrary JavaScript in the context of the Statamic CMS domain. This can lead to session hijacking, data theft, or defacement, depending on the privileges of the victim user. The advisory notes that this issue is a cross-site scripting vulnerability, and the CVSS v4.0 vector (if published) would reflect that. [1][4]

Mitigation

The vulnerability has been patched in Statamic CMS versions 3.4.15 and 4.36.0. Users are strongly advised to upgrade to these versions or later. The release notes confirm the fix was included in these specific tag releases. [2]