CVE-2026-49287 Overview
Statamic is a Laravel and Git powered content management system (CMS). CVE-2026-49287 affects Statamic versions prior to 5.73.23 and 6.20.0. The vulnerability stems from an incomplete fix for CVE-2026-41175. The original patch addressed the issue in the query builder but failed to apply the same protection to in-memory collection sorting. Attackers manipulating sort parameters can cause loss of content and assets. Exploitation requires a front-end template that passes request input into a tag's sort parameter. The issue is not exploitable by default, since templates must be explicitly configured to sort by visitor-controlled values.
Critical Impact
Manipulation of sort parameters in vulnerable Statamic templates can lead to loss of content and assets, compromising integrity and availability.
Affected Products
- Statamic CMS versions prior to 5.73.23
- Statamic CMS versions prior to 6.20.0
- Laravel-based applications using vulnerable Statamic releases
Discovery Timeline
- 2026-06-19 - CVE-2026-49287 published to NVD
- 2026-06-23 - Last updated in NVD database
Technical Details for CVE-2026-49287
Vulnerability Analysis
CVE-2026-49287 is a control of dynamically-managed code resources issue [CWE-470]. The flaw resides in how Statamic processes sort parameters when working with in-memory collections. The earlier remediation for CVE-2026-41175 hardened the query builder path but left in-memory sorting unprotected. When a template passes untrusted request input directly into a tag's sort parameter, an attacker can supply crafted values that influence how the collection sort logic resolves. The result is unintended manipulation of collection ordering and underlying data, leading to loss of content and assets.
Root Cause
The root cause is an incomplete patch. The query builder received input validation for sort parameters, but the parallel code path performing in-memory collection sorting did not receive equivalent protection. This inconsistency allows visitor-controlled values to reach a sensitive sort routine.
Attack Vector
The attack vector is network-based and unauthenticated. An attacker submits crafted HTTP request input that a front-end template forwards into a Statamic tag's sort parameter. Exploitation is contingent on a developer explicitly wiring request input into the sort attribute. Default templates are not vulnerable.
No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-4jjr-vmv7-wh4w and GitHub Security Advisory GHSA-m92m-r54r-x8r2 for technical details.
Detection Methods for CVE-2026-49287
Indicators of Compromise
- Unexpected loss or reordering of entries, assets, or collection items in Statamic-managed content
- HTTP request logs containing unusual or malformed values supplied to sort query parameters
- Front-end templates that reference {{ get:sort }}, {{ post:sort }}, or similar request-bound values within tag parameters
Detection Strategies
- Audit Statamic templates for any tag that binds request input into a sort parameter
- Review web server access logs for high-entropy or non-allowlisted sort parameter values
- Compare current Statamic version against fixed releases 5.73.23 and 6.20.0
Monitoring Recommendations
- Enable verbose application logging around Statamic collection and asset operations
- Alert on anomalous content deletions or bulk asset changes outside change-management windows
- Track outbound requests and template render errors that correlate with crafted sort inputs
How to Mitigate CVE-2026-49287
Immediate Actions Required
- Upgrade Statamic to version 5.73.23 or 6.20.0 as soon as possible
- Inventory all front-end templates and remove direct binding of request input to tag sort parameters
- Restore content and assets from backup if loss is observed in production
Patch Information
The vulnerability is fixed in Statamic 5.73.23 and 6.20.0. The patches extend the sort parameter validation previously applied to the query builder to also cover in-memory collection sorting. Refer to the official advisories: GHSA-4jjr-vmv7-wh4w and GHSA-m92m-r54r-x8r2.
Workarounds
- Replace dynamic sort bindings with a static allowlist of permitted sort fields in templates
- Validate and sanitize request input before passing it into any Statamic tag parameter
- Restrict access to affected endpoints until the upgrade is deployed
# Configuration example - upgrade Statamic via Composer
composer require statamic/cms:^6.20.0
# or for the 5.x branch
composer require statamic/cms:^5.73.23
php artisan cache:clear
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
