Description
Statamic is a, Laravel + Git powered CMS designed for building websites. Prior to 5.73.6 and 6.2.5, users without permission to view assets are able are able to download them and view their metadata. Logged-out users and users without permission to access the control panel are unable to take advantage of this. This has been fixed in 5.73.6 and 6.2.5.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| statamic | cms | < 5.73.6, >= 6.0.0-alpha.1, < 6.2.5 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | statamic/cms | < 5.73.6 | 5.73.6 | GHSA-gwmx-9gcj-332h |
| Packagist | statamic/cms | >= 6.0.0-alpha.1, < 6.2.5 | 6.2.5 | GHSA-gwmx-9gcj-332h |