CVE-2026-33885CWE-601

Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential

Medium · published March 27, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
22.0
In the wild
Unconfirmed
What it is

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the external URL detection used for redirect validation on unauthenticated endpoints could be bypassed, allowing users to be redirected to external URLs after actions like form submissions and authentication flows. This has been fixed in 5.73.16 and 6.7.2.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00304 · 22.0th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-03-27T20:39Z
EPSS history
Timeline
  • 27 MAR 20:39Z
    Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential
    cvelistv5