Packagist/statamic/cms CVE-2026-27593: critical 9.3, EPSS 0.63%
Statamic is vulnerable to account takeover via password reset link injection
Action: Upgrade statamic/cms to 5.73.10 or later.
composer require statamic/cms:5.73.10composer require statamic/cms:6.7.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.73.10 | - |
| 6.0.0-alpha.1 | 6.7.1 | - |
Fixed versions
| 5.73.10 | 6.7.1 |
Sources
- osv: GHSA-jxq9-79vj-rgvw
- https://github.com/statamic/cms/security/advisories/GHSA-jxq9-79vj-rgvw
- https://nvd.nist.gov/vuln/detail/CVE-2026-27593
- https://github.com/statamic/cms/commit/6fdd03324982848e8754f2edd2265262d361714e
- https://github.com/statamic/cms/commit/78e63dfcf705b116d5ac0f7f7f5a1a69be63d1be
- https://github.com/statamic/cms/commit/b2be592ddfb588bcb88c9be454f3590e14b145b0
- https://github.com/statamic/cms
- https://github.com/statamic/cms/releases/tag/v5.73.10
- https://github.com/statamic/cms/releases/tag/v6.3.3
CVE-2026-27593 · published · modified · JSON