CVE-2026-33171: Statamic CMS Path Traversal Vulnerability

CVE-2026-33171 Overview

CVE-2026-33171 is a Path Traversal vulnerability in Statamic, a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, authenticated Control Panel users could read arbitrary .json, .yaml, and .csv files from the server by manipulating the file dictionary's filename configuration parameter in the fieldtype's endpoint.

Critical Impact
Authenticated attackers can access sensitive configuration files containing credentials, API keys, and other sensitive data stored in JSON, YAML, or CSV formats on the server.

Affected Products

Statamic CMS versions prior to 5.73.14
Statamic CMS versions 6.x prior to 6.7.0

Discovery Timeline

2026-03-20 - CVE-2026-33171 published to NVD
2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-33171

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Path Traversal), which occurs when user-supplied input is used to construct a file path without proper sanitization. In Statamic CMS, authenticated users with access to the Control Panel can exploit the file dictionary fieldtype endpoint by manipulating the filename parameter to traverse directories and access files outside the intended scope.

The attack requires network access and valid authentication credentials for the Control Panel. While authentication is required, this significantly reduces the attack surface compared to unauthenticated vulnerabilities. The impact is limited to confidentiality, as attackers can only read files—not modify or delete them—and only files with .json, .yaml, or .csv extensions are accessible through this vector.

Root Cause

The root cause is improper input validation in the file dictionary fieldtype's endpoint handler. The filename configuration parameter does not adequately sanitize path traversal sequences such as ../ before constructing the file path. This allows authenticated users to navigate outside the intended directory structure and access sensitive files elsewhere on the server filesystem.

Attack Vector

The vulnerability is exploited through the network by sending crafted requests to the fieldtype endpoint with path traversal sequences embedded in the filename parameter. An authenticated attacker can manipulate this parameter to traverse directories and read configuration files, environment files, or other sensitive data stored in JSON, YAML, or CSV formats.

For example, an attacker could target Laravel's configuration files or any application-specific data files stored in these formats. Since Statamic is built on Laravel, files like config/*.php would not be directly readable, but any JSON or YAML configuration files used by the application or its dependencies could be exposed.

The exploitation mechanism involves manipulating directory traversal sequences within the filename parameter to escape the intended file path restrictions. For detailed technical information about this vulnerability, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-33171

Indicators of Compromise

HTTP requests to fieldtype endpoints containing path traversal sequences (../, ..%2F, ..%5C) in the filename parameter
Unusual file access patterns from the web application user targeting configuration directories
Access logs showing repeated requests to dictionary fieldtype endpoints with varying filename values
Error logs indicating attempts to access files outside the expected directory structure

Detection Strategies

Monitor web application logs for requests containing directory traversal patterns in query parameters or request bodies
Implement Web Application Firewall (WAF) rules to detect and block path traversal attempts in HTTP requests
Review audit logs for authenticated Control Panel users accessing unusual endpoints or making atypical requests
Deploy file integrity monitoring on sensitive configuration directories to detect unauthorized read attempts

Monitoring Recommendations

Enable detailed request logging for the Statamic Control Panel endpoints to capture parameter values
Configure alerts for path traversal signatures in request parameters across all web-facing applications
Monitor for anomalous patterns in authenticated user behavior, particularly bulk or scripted requests to fieldtype endpoints
Implement real-time log analysis to identify potential exploitation attempts before sensitive data is exfiltrated

How to Mitigate CVE-2026-33171

Immediate Actions Required

Upgrade Statamic CMS to version 5.73.14 or later for the 5.x branch
Upgrade Statamic CMS to version 6.7.0 or later for the 6.x branch
Review access logs to identify any potential exploitation attempts prior to patching
Audit Control Panel user accounts and remove unnecessary access privileges

Patch Information

Statamic has released security patches addressing this vulnerability. The fix is included in versions 5.73.14 and 6.7.0. Update your Statamic installation using Composer:

bash

composer update statamic/cms

For additional details, refer to the GitHub Security Advisory GHSA-qm7r-wwq7-6f85.

Workarounds

Restrict Control Panel access to only trusted administrators until the patch can be applied
Implement network-level access controls (IP allowlisting) for the Control Panel routes
Deploy a Web Application Firewall with rules to block path traversal sequences in request parameters
Consider temporarily disabling the file dictionary fieldtype if it is not critical to operations