MEDIUM 6.5
GHSA-j2vp-f2pv-5rj4
Statamic: Unsafe method invocation via Antlers template resolution allows data destruction
Quick fix
GHSA-j2vp-f2pv-5rj4 — statamic/cms: upgrade to the fixed version with the command below.
composer require statamic/cms:^5.74.1Details
### Impact
Manipulating user-supplied input incorporated into Antlers templates could result in the loss of content and assets.
Exploitation requires a site to have templates that pass untrusted input into affected areas. It does not require authentication.
### Patches
This has been fixed in 5.74.1 and 6.24.0.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist / statamic/cms
Introduced in:
0 Fixed in: 5.74.1 Fix
composer require statamic/cms:^5.74.1 Packagist / statamic/cms
Introduced in:
6.0.0 Fixed in: 6.24.0 Fix
composer require statamic/cms:^6.24.0