8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28425

CVE-2026-28425: Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, an authenticated control panel user with access to Antlers-enabled inputs may be able to achieve remote code execution in the application context. That can lead to full compromise of the application, including access to sensitive configuration, modification or exfiltration of data, and potential impact on availability. Exploitation is only possible where Antlers runs on user-controlled content—for example, content fields with Antlers explicitly enabled (requiring permission to configure fields and to edit entries), built-in config that supports Antlers such as Forms email notification settings (requiring configuration permission), or third-party addons that add Antlers-enabled fields to entries (for example, the SEO Pro addon). In each case the attacker must have the relevant control panel permissions. This has been fixed in 5.73.16 and 6.7.2. Users of addons that depend on Statamic should ensure that after updating they are running a patched Statamic version.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28425

CVE-2026-28425:

8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
statamic/cms	composer	< 5.73.11	5.73.11
statamic/cms	composer	>= 6.0.0-alpha.1, < 6.4.0	6.4.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a remote code execution flaw within Statamic's Antlers templating engine. The root cause is the lack of separation between parsing trusted developer-created templates and untrusted user-provided content. An authenticated user with permissions to edit content in fields where Antlers parsing is enabled could inject malicious template code.

The analysis of the security patches reveals several key vulnerable components:

Statamic\View\Antlers\Antlers::parse: This was the primary insecure function. It processed template strings without any sandboxing, treating all input as trusted. The patches refactor this to operate in a "trusted" or "untrusted" mode, with untrusted being the default to prevent accidental misuse.
Method and Tag Execution: The functions Statamic\View\Antlers\Language\Runtime\Sandbox\Environment::process, ModifierManager::guardRuntimeModifier, and NodeProcessor::guardRuntimeTag were responsible for executing methods, modifiers, and tags within a template. They did not check if the template being processed was from an untrusted source, allowing an attacker to call arbitrary PHP methods and use dangerous tags/modifiers.
Information Disclosure: The Statamic\View\Cascade::contextualVariables function exposed all application configuration variables (including secrets like database passwords and API keys) to the template context. An attacker could simply use a template variable like {{ config:database.connections.mysql.password }} to read and exfiltrate this sensitive data.

The patches address these issues by introducing a sandboxing mechanism. When parsing user content (isEvaluatingUserData is true), the engine now operates with a strict allow-list of safe tags and modifiers, disables arbitrary method calls, and provides only a minimal, safe subset of configuration variables.

Vulnerable functions

Statamic\View\Antlers\Antlers::parse

src/View/Antlers/Antlers.php

This is the central Antlers parsing function. Prior to the patch, it would parse and evaluate any string in a fully trusted context. When this function was used on user-controlled input (e.g., from a CMS field), it allowed for the execution of arbitrary PHP methods and access to sensitive application data, leading to remote code execution.

Statamic\View\Antlers\Language\Runtime\Sandbox\Environment::process

src/View/Antlers/Language/Runtime/Sandbox/Environment.php

This function processes the parsed Antlers syntax tree. The vulnerability lies in its handling of `MethodInvocationNode` objects. Before the patch, it would execute any method call it encountered. An attacker could craft a string with a method call on an available object (e.g., `{{ some_object:some_method() }}`) to achieve remote code execution. The patch blocks method calls when processing untrusted user content.

Statamic\View\Cascade::contextualVariables

src/View/Cascade.php

This function gathers and provides contextual data to the rendering engine. It was vulnerable because it included the entire application configuration (`config()->all()`) in the data available to Antlers templates. This exposed sensitive information like API keys, database credentials, and other secrets, which could be exfiltrated by an attacker through a malicious template.

Statamic\View\Antlers\Language\Runtime\ModifierManager::guardRuntimeModifier

src/View/Antlers/Language/Runtime/ModifierManager.php

This function is responsible for checking if a given Antlers modifier is allowed to run. In the vulnerable version, there was no mechanism to restrict which modifiers could be used in untrusted user content. This allowed an attacker to use potentially dangerous modifiers to manipulate data, trigger code execution, or bypass security controls. The patch introduces an allow-list for modifiers that are safe to use in user content.

Statamic\View\Antlers\Language\Runtime\NodeProcessor::guardRuntimeTag

src/View/Antlers/Language/Runtime/NodeProcessor.php

This function checks if a given Antlers tag is allowed to be executed. The vulnerability was that it did not differentiate between a trusted template and untrusted user content, allowing any registered tag to be executed. An attacker could use a powerful or misconfigured tag to read files, execute code, or exfiltrate data. The patch introduces an allow-list for tags that are safe for use in user content.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.