Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs

Vulnerability

Overview

CVE-2026-28425 is a remote code execution (RCE) vulnerability in Statamic, a Laravel and Git powered CMS. The flaw resides in the Antlers template engine, which allows user-supplied content to be processed as template code. Prior to versions 5.73.16 and 6.7.2, an authenticated control panel user with access to Antlers-enabled inputs could inject arbitrary Antlers expressions, leading to code execution in the application context [1][4]. The root cause is insufficient sanitization of user-controlled content processed by the Antlers engine.

Exploitation

Conditions

Exploitation requires the attacker to be an authenticated user with specific control panel permissions. The vulnerability is present in any input where Antlers is explicitly enabled: content fields with Antlers enabled (requiring field configuration and entry edit permissions), built-in configurations such as Forms email notification settings (requiring configuration permission), or third-party addons like SEO Pro that add Antlers-enabled fields [1][4]. The attacker must have the relevant control panel permissions for each attack vector, meaning not all authenticated users can exploit this without proper privileges.

Impact

Successful exploitation allows an attacker to achieve remote code execution within the application context. This could lead to full compromise of the application, including access to sensitive configuration data, modification or exfiltration of data, and potential impact on availability [1][4]. The severity is high given the potential for complete loss of confidentiality, integrity, and availability.

Mitigation

The vulnerability has been patched in Statamic versions 5.73.16 and 6.7.2 [1][2][4]. Users should upgrade to these versions immediately. Administrators of addons that depend on Statamic should ensure they are running a patched Statamic version after updating [4]. No workarounds are provided; the fix requires updating the core CMS package.