CVE-2026-33886 — Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields

CVE-2026-33886

Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields PUBLISHED

Description (CNA)

Statamic is a Laravel and Git powered content management system (CMS). Starting in version 5.7.12 and prior to versions 5.73.16 and 6.7.2, a control panel user with access to Antlers-enabled fields could access sensitive application configuration values by inserting config variables into their content. This has been fixed in 5.73.16 and 6.7.2.

Affected (CNA)

Vendor / product	Versions
statamic / cms	affected >= 5.73.12, < 5.73.16; affected >= 6.0.0.alpha.1, < 6.7.2

CWE

CWE-200

References

https://github.com/statamic/cms/security/advisories/GHSA-gcqf-5x9f-hq7f

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.