CVE-2026-33171CWE-22

Statamic has a path traversal in file dictionary fieldtype

Medium · published March 20, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
28.9
In the wild
Unconfirmed
What it is

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, authenticated Control Panel users could read arbitrary `.json`, `.yaml`, and `.csv` files from the server by manipulating the file dictionary's `filename` configuration parameter in the fieldtype's endpoint. This has been fixed in 5.73.14 and 6.7.0.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00363 · 28.9th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-03-20T21:39Z
EPSS history
Timeline
  • 20 MAR 21:39Z
    Statamic has a path traversal in file dictionary fieldtype
    cvelistv5