CVE-2026-54243 Details
Description
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, form submission values in src/Forms/Exporters/CsvExporter.php were not neutralized for spreadsheet formula characters when exported to CSV. A submission containing a value beginning with a formula trigger character, such as =, +, -, or @, could be interpreted as a live formula when a Control Panel user opens the export in a spreadsheet application. Form submissions can come from unauthenticated front-end visitors, so the malicious value can be supplied by an anonymous user and is later triggered by an editor opening the export. This issue is fixed in versions 5.73.24 and 6.20.1.
A vulnerability in Statamic CMS versions prior to 5.73.24 and 6.20.1 allows for formula injection in CSV exports of form submissions. The issue arises because submission values were not properly sanitized to remove spreadsheet formula characters. As a result, when an export is opened in a spreadsheet application, values starting with formula trigger characters like '=', '+', '-', or '@' could be interpreted as live formulas. This vulnerability can be exploited by anonymous users through the front-end, with the malicious payload activated when an editor opens the exported file.
Users can upgrade to Statamic versions 5.73.24 or 6.20.1, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 17, 2026CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/statamic/cms/commit/f17c098e52a92597fc5f81bd287700b3d05f4add | [email protected] | Source CodeVendor |
| https://github.com/statamic/cms/pull/14760 | [email protected] | Issue TrackingVendor |
| https://github.com/statamic/cms/releases/tag/v5.73.24 | [email protected] | Release NotesVendor |
| https://github.com/statamic/cms/releases/tag/v6.20.1 | [email protected] | Release NotesVendor |
| https://github.com/statamic/cms/security/advisories/GHSA-h77m-qrj7-jxcw | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1236 | Improper Neutralization of Formula Elements in a CSV File | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Statamic | < 5.73.24 (semver) < 6.20.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |