# Unsafe deserialization in statamic/importer

- **Reference**: HI-SA-2026-003
- **Type**: Vulnerability
- **Severity**: High
- **Platform**: Packagist
- **Package**: statamic/importer
- **Affected versions**: <2.3.4
- **Fixed in**: 2.3.4
- **CWE**: CWE-502: Insecure deserialization
- **CVSS 4.0**: 9.4 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
- **CVSS 3.1**: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- **Researched by**: [Joshua van der Poll](https://hackindex.nl/en/author/joshua-van-der-poll)

statamic/importer up to and including 2.3.3 turned certain values from an import file into PHP objects without any restriction. An attacker who can influence a file you import, such as an export from another site or an external feed, could use that to run code on your server. No account on your site is needed, only an admin importing that file. Statamic fixed it in 2.3.4, published an advisory and requested a CVE.

## Who it affects

- Statamic sites with statamic/importer up to and including 2.3.3
- Sites that import files from sources you do not control, such as a WordPress export, CSV or external feed
- Imports that map a column to a list or entries field

## How to fix it

Update to 2.3.4. The importer no longer turns import values into objects there. Until then, only import files from sources you trust. If you imported third-party files with a version up to and including 2.3.3, check the server for unexpected files or processes.

```
composer update statamic/importer
```

## Timeline

- 2026-11-07: Vulnerability found in the published code of 1.x and 2.3.3
- 2026-11-07: Impact confirmed in a test environment
- 2026-11-07: Reported privately to Statamic through GitHub
- 2026-11-12: Fixed in 2.3.4, advisory GHSA-x79m-fxfp-83hx published, CVE requested

## References

- [GitHub Security Advisory GHSA-x79m-fxfp-83hx](https://github.com/statamic/importer/security/advisories/GHSA-x79m-fxfp-83hx)
- [Repository on GitHub](https://github.com/statamic/importer)

## About this report

HackIndex does pentests and code review, and researches open-source packages, plugins and extensions. A vulnerability goes to the maker first, malware straight to the platform that spreads it.

Questions about this report or a correction? Mail the address in security.txt with HI-SA-2026-003 in the subject.

You may reuse this report under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), with the reference and this URL as source.

- [Why HackIndex does research](https://hackindex.nl/en/research)
- [Deadlines and agreements](https://hackindex.nl/en/security)
- [security.txt](https://hackindex.nl/.well-known/security.txt)

Source: https://hackindex.nl/en/research/hi-sa-2026-003