GHSA-vx89-p3j7-8xqc: Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template
Impact
The default ("automagic") form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the configured recipients
Patches
This has been fixed in 5.74.3 and 6.24.2.
Details
Original advisory: https://github.com/advisories/GHSA-vx89-p3j7-8xqc
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-71435 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
More from GitHub Security Advisories
- mediumGHSA-957r-qf9p-67xw: Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts2026-08-06
- mediumGHSA-6hr6-w5qg-qmwg: h2: Duplicate Host header could facilitate request smuggling2026-08-06
- mediumGHSA-596p-6jv8-775v: Craft CMS: Authenticated leak of secret environment variables2026-08-06
- mediumGHSA-rvmm-v933-jgxq: Craft CMS: Missing authorization check allows non-admin control panel users access to use…2026-08-06
- lowGHSA-7hxc-f267-h5q7: Craft CMS: Incorrect path validation could potentially lead to path traversal2026-08-06