CVE-2026-49287: Statamic Data Loss Vulnerability in Collection Sorting

Technical summary

CVE-2026-49287 is a CWE-470 (Use of Externally-Controlled Input to Select Classes or Code) vulnerability stemming from an incomplete remediation of CVE-2026-41175. The original fix applied input sanitization to the query builder's sort operations, but the same protections were not consistently applied to in-memory collection sorting. An attacker who can influence the sort parameter in Statamic tags can trigger unintended code paths or unsafe object instantiation during the sorting process, resulting in uncontrolled modification or deletion of data. The attack vector is network-based with no authentication required, though successful exploitation depends on template design choices made by the site administrator.

Business impact

A successful exploit allows an attacker to destroy or corrupt website content and digital assets without authorization. For content-driven businesses—publishers, agencies, e-commerce platforms—this translates to immediate availability loss, reputational damage, and potential compliance violations if customer data or regulated content is affected. Recovery may require restore operations, downtime, and manual audit work. Organizations relying on Statamic for customer-facing content delivery face operational disruption and trust erosion.

Affected systems

Statamic versions prior to 5.73.23 (stable branch) and 6.20.0 (current branch) are vulnerable. The vulnerability is only exploitable if: (1) the Statamic installation includes front-end templates that pass request parameters directly into tag sort arguments, AND (2) those templates are accessible to unauthenticated users. Default Statamic configurations are not exploitable. Custom templates that explicitly use visitor input for sorting—such as e-commerce category pages allowing users to sort products—present the greatest risk.

Exploitability

Exploitation requires network access and does not demand authentication or user interaction. However, the practical attack surface is limited by template design: only sites with templates that bind user-supplied sort parameters to Statamic tags are vulnerable. An attacker would send crafted HTTP requests with malicious sort parameter values to trigger the vulnerability. The CVSS score of 7.4 (HIGH) reflects the severity of the impact (integrity and availability) tempered by the conditional nature of the vulnerability. No active exploitation in the wild has been reported, and the vulnerability is not tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Upgrade Statamic to version 5.73.23 or later for the stable branch, or version 6.20.0 or later for the current branch. These releases include the complete fix for in-memory collection sorting. After patching, verify that any custom templates using user-controlled sort parameters are reviewed and tested to ensure proper input validation and safe operation.

Patch guidance

Review your Statamic installation's current version by checking composer.json or the admin panel. If running version 5.x, update to 5.73.23 or higher. If running version 6.x, update to 6.20.0 or higher. Use composer update statamic/cms to apply the patch in your project environment. Test the patch in a staging environment first, particularly focusing on any custom templates that perform sorting operations. No breaking changes have been reported in these patch releases.

Detection guidance

Review your Statamic templates for any that accept and use visitor input (request parameters, query strings, form submissions) within sort directives or collection sorting operations. Search for patterns such as {{ entries:list sort="{request:sort}" }} or similar constructs. Monitor web server access logs for unusual sort parameter values—particularly those containing suspicious syntax or repeating patterns that suggest an attacker is probing for vulnerabilities. Once patched, test your vulnerable templates to confirm they now safely handle malicious input without data loss.

Why prioritize this

This vulnerability merits rapid patching because: (1) the impact is severe—permanent data loss—with high business consequences, (2) the network-accessible attack vector means any vulnerable template is a potential entry point, and (3) the incomplete nature of the prior fix suggests incomplete threat modeling. While template-specific exploitability reduces risk for some organizations, any site discovered to use dynamic sorting should be treated as critical priority. Organizations should patch within 1–2 weeks unless a thorough template audit proves no vulnerable patterns exist.

Risk score, explained

The CVSS 3.1 score of 7.4 (HIGH) is driven by high impact on integrity and availability (no confidentiality impact), network-based attack vector, and the absence of authentication requirements. The High complexity (AC:H) modifier reflects the conditional requirement that templates must be explicitly configured to pass user input to sort parameters. Organizations with no custom dynamic sorting are at negligible risk; those with such templates face critical risk. The score appropriately represents the worst-case scenario while acknowledging that not all Statamic installations are vulnerable.

Frequently asked questions