Statamic has a path traversal in file dictionary fieldtype

Vulnerability

A path traversal vulnerability exists in the Statamic CMS file dictionary fieldtype endpoint. Prior to versions 5.73.14 and 6.7.0, authenticated Control Panel users could read arbitrary .json, .yaml, and .csv files from the server by manipulating the filename configuration parameter [1][3].\. The root cause is insufficient validation of the user-supplied filenames, allowing traversal outside the intended directory.

Exploitation

An attacker must be an authenticated user with access to the Statamic Control Panel. The attack can be carried out locally or remotely, as the web interface exposes this endpoint. The complexity is low: only a crafted filename parameter is needed; no additional privileges or user interaction beyond authentication are required [3\.

Impact

Successful exploitation results in unauthorized read access to arbitrary JSON, YAML, and CSV files on the server filesystem. This could expose sensitive configuration data, credentials, or other confidential information, leading to a breach of confidentiality [3\. Integrity and availability are not directly affected.

Mitigation

The vulnerability has been fixed in Statamic CMS versions 5.73.14 and 6.7.0 [1][2]. Users should update to these patched versions immediately. No workarounds have been publicly documented.