Executive brief
Statamic is a content management system used to build and manage websites. A vulnerability in its form export feature allows anonymous website visitors to submit malicious data that, when exported to a CSV file and opened by an administrator in a spreadsheet program like Excel, can execute unauthorized commands or formulas. This could lead to local data exposure or manipulation on the administrator's computer.
Technical details
A CSV Injection (CWE-1236) vulnerability exists in Statamic's `src/Forms/Exporters/CsvExporter.php` component. The application fails to neutralize formula trigger characters (such as =, +, -, or @) in user-submitted form data before including them in CSV exports. An unauthenticated attacker can submit a form containing a malicious payload; when a privileged user exports these submissions and opens the file in a spreadsheet application, the payload is executed as a live formula. This can lead to information disclosure or limited data modification within the context of the spreadsheet application. The issue is resolved in versions 5.73.24 and 6.20.1.
Affected products
- Statamic cms < 5.73.24, >= 6.0.0 < 6.20.1
Timeline
- 2026-06-02: patched: Fixes merged into 5.x and 6.x branches
- 2026-06-03: advisory: GitHub Security Advisory GHSA-h77m-qrj7-jxcw published
- 2026-07-17: disclosed: CVE-2026-54243 published to NVD