Is CVE-2026-54243 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54243 being exploited in the wild.

How severe is CVE-2026-54243?

Medium severity, with a CVSS score of 6.1, published 17 July 2026.

Which products and versions are affected?

statamic/cms (Packagist) ECOSYSTEM:introduced=6.0.0,fixed=6.20.1; Statamic = 6.0.0 = 6.0.0, < 6.20.1.

Is there a fix for CVE-2026-54243?

Yes. statamic/cms (Packagist): upgrade to 6.20.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54243 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-54243?

Check whether you run statamic/cms (Packagist) or Statamic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54243: Statamic CMS CSV injection in form submission exports

Q: Is there a fix for CVE-2026-54243?

Yes. statamic/cms (Packagist): upgrade to 6.20.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54243 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-54243?

Check whether you run statamic/cms (Packagist) or Statamic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54243 · Severity: medium · CVSS 6.1 · Published 2026-07-17

Statamic is a content management system used to build and manage websites. A vulnerability in its form export feature allows anonymous website visitors to submit malicious data that, when exported to a CSV file and opened by an administrator in a spreadsheet program like Excel, can execute unauthorized commands or formulas. This could lead to local data exposure or manipulation on the administrator's computer.

Technologies: statamic/cms (Packagist), Statamic. Vendors: Packagist, Statamic.

Quick answers

Is CVE-2026-54243 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54243 being exploited in the wild.
How severe is CVE-2026-54243?: Medium severity, with a CVSS score of 6.1, published 17 July 2026.
Which products and versions are affected?: statamic/cms (Packagist) ECOSYSTEM:introduced=6.0.0,fixed=6.20.1; Statamic < 5.73.24, >= 6.0.0 < 6.20.1, < 5.73.24, >= 6.0.0, < 6.20.1.
Is there a fix for CVE-2026-54243?: Yes. statamic/cms (Packagist): upgrade to 6.20.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54243 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-54243?: Check whether you run statamic/cms (Packagist) or Statamic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

statamic/cms (Packagist): upgrade to 6.20.1 or later
```
composer require statamic/cms:^6.20.1
```

Technical details

A CSV Injection (CWE-1236) vulnerability exists in Statamic's `src/Forms/Exporters/CsvExporter.php` component. The application fails to neutralize formula trigger characters (such as =, +, -, or @) in user-submitted form data before including them in CSV exports. An unauthenticated attacker can submit a form containing a malicious payload; when a privileged user exports these submissions and opens the file in a spreadsheet application, the payload is executed as a live formula. This can lead to information disclosure or limited data modification within the context of the spreadsheet application. The issue is resolved in versions 5.73.24 and 6.20.1.

Affected products

Statamic cms < 5.73.24, >= 6.0.0 < 6.20.1

Identifiers

CVE-2026-54243
GHSA-h77m-qrj7-jxcw

Timeline

2026-06-02: patched: Fixes merged into 5.x and 6.x branches
2026-06-03: advisory: GitHub Security Advisory GHSA-h77m-qrj7-jxcw published
2026-07-17: disclosed: CVE-2026-54243 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.