CVE-2026-71435

{
  "id": "CVE-2026-71435",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-06T22:18:30.423",
  "lastModified": "2026-10-24T15:10:00.190",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, the default (\"automagic\") form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the configured recipients. This issue is fixed in versions 5.74.3 and 6.24.2."
    },
    {
      "lang": "es",
      "value": "Statamic es un sistema de gestión de contenido (CMS) impulsado por Laravel y Git. Antes de 5.74.3 y 6.24.2, el correo electrónico de notificación de formulario predeterminado (’automágico’) renderizaba los valores enviados por el usuario sin escapar, permitiendo que un remitente de formulario no autenticado inyectara HTML en los correos electrónicos de notificación enviados a los destinatarios configurados. Este problema está solucionado en las versiones 5.74.3 y 6.24.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "statamic",
          "product": "cms",
          "versions": [
            {
              "version": "< 5.74.3",
              "status": "affected"
            },
            {
              "version": ">= 6.0.0, < 6.24.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-08T02:31:13.526218Z",
          "id": "CVE-2026-71435",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/statamic/cms/commit/4ad1335e818a67249d0617f0f167a1198fb96a2c",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/statamic/cms/pull/14959",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/statamic/cms/releases/tag/v5.74.3",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/statamic/cms/releases/tag/v6.24.2",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/statamic/cms/security/advisories/GHSA-vx89-p3j7-8xqc",
      "source": "[email protected]"
    }
  ]
}