{"action":"Upgrade statamic/cms to 5.74.3 or later.","affected":[{"fixed":"5.74.3","introduced":"0"},{"fixed":"6.24.2","introduced":"6.0.0"}],"component":"statamic/cms","cve_ids":["CVE-2026-71434"],"ecosystem":"Packagist","epss":0.00412,"exploited":false,"fixed_versions":["5.74.3","6.24.2"],"ghsa_id":"GHSA-qhr7-v3xp-vw9m","id":"tcs_01M5KF7BHHX2H7P9EZTSCEYG6G","modified_at":"2026-08-06T19:56:06.421799Z","published_at":"2026-08-06T19:35:00Z","references":["https://osv.dev/vulnerability/GHSA-qhr7-v3xp-vw9m","https://github.com/statamic/cms/security/advisories/GHSA-qhr7-v3xp-vw9m","https://github.com/statamic/cms/pull/14958","https://github.com/statamic/cms/commit/8be7b6c961536d3173ec4e0965d17b1cf820b7ae","https://github.com/statamic/cms","https://github.com/statamic/cms/releases/tag/v5.74.3","https://github.com/statamic/cms/releases/tag/v6.24.2"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-qhr7-v3xp-vw9m","url":"https://osv.dev/vulnerability/GHSA-qhr7-v3xp-vw9m"}],"summary":"Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types"}