HI-SA-2026-003 High Published Vulnerability
Unsafe deserialization in statamic/importer
statamic/importer up to and including 2.3.3 turned certain values from an import file into PHP objects without any restriction. An attacker who can influence a file you import, such as an export from another site or an external feed, could use that to run code on your server. No account on your site is needed, only an admin importing that file. Statamic fixed it in 2.3.4, published an advisory and requested a CVE.
Who it affects
- Statamic sites with statamic/importer up to and including 2.3.3
- Sites that import files from sources you do not control, such as a WordPress export, CSV or external feed
- Imports that map a column to a list or entries field
How to fix it
composer update statamic/importer
Update to 2.3.4. The importer no longer turns import values into objects there. Until then, only import files from sources you trust. If you imported third-party files with a version up to and including 2.3.3, check the server for unexpected files or processes.
Timeline
- Vulnerability found in the published code of 1.x and 2.3.3
- Impact confirmed in a test environment 0 days
- Reported privately to Statamic through GitHub 0 days
- Fixed in 2.3.4, advisory GHSA-x79m-fxfp-83hx published, CVE requested 5 days
References
About this report
HackIndex does pentests and code review, and researches open-source packages, plugins and extensions. A vulnerability goes to the maker first, malware straight to the platform that spreads it.
Questions about this report or a correction? Mail info [at] hackindex [dot] nl with HI‑SA‑2026‑003 in the subject.
You may reuse this report under CC BY 4.0 (opens in a new tab), with the reference and this URL as source.
Why HackIndex does research Deadlines and agreements About HackIndex
Have it checked
Flaws like this often sit in the way an app uses a package. A security code review looks at that on purpose.