CVE-2026-64663

mediumCVSS 6.5covered by 2 sourcesfirst seen 2026-08-06

Impact Manipulating user-supplied input incorporated into Antlers templates could result in the loss of content and assets. Exploitation requires a site to have templates that pass untrusted input into affected areas. It does not require authentication. Patches This has been fixed in 5.74.1 and 6.24.0.

⚡ Watch CVE-2026-64663

Get an email if CVE-2026-64663 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (2)

mediumCVE-2026-64663: Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.2…nvd · 2026-08-06
mediumGHSA-j2vp-f2pv-5rj4: Statamic: Unsafe method invocation via Antlers template resolution allows data destructio…ghsa · 2026-08-06

External references

NVD record for CVE-2026-64663

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-64663 status](https://www.csirts.com/badge/CVE-2026-64663)](https://www.csirts.com/cve/CVE-2026-64663)