CVE-2023-48217 is a critical vulnerability affecting Statamic CMS versions prior to 3.4.14 and 4.34.0, allowing attackers to upload and execute malicious PHP files disguised as images. This flaw bypasses mime type validation in both front-end forms and control panel asset uploads. With a CVSS score of 8.8 (High), it presents a significant risk due to its low attack complexity and potential for complete compromise of confidentiality, integrity, and availability. While no public exploits or active exploitation have been observed, and community discussion is minimal, immediate patching is strongly advised as there are no known workarounds.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 3.4.14CPE matchmatch criteria | cpe:2.3:a:statamic:statamic:*:*:*:*:*:*:*:* | ||
>= 4.0.0, < 4.34.0CPE matchmatch criteria | cpe:2.3:a:statamic:statamic:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.