# CVE-2026-54243: Statamic CMS CSV injection in form submission exports

Source: https://junglewise.ai/threats/cve-2026-54243-statamic-cms-csv-injection-in-form-submission-exports  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-17. Updated: 2026-07-17  
License: CC BY 4.0 with a link back

CVE-2026-54243 · Severity: medium · CVSS 6.1 · Published 2026-07-17

Statamic is a content management system used to build and manage websites. A vulnerability in its form export feature allows anonymous website visitors to submit malicious data that, when exported to a CSV file and opened by an administrator in a spreadsheet program like Excel, can execute unauthorized commands or formulas. This could lead to local data exposure or manipulation on the administrator's computer.

Technologies: [statamic/cms (Packagist)](https://junglewise.ai/threats/technologies/statamic-cms), [Statamic](https://junglewise.ai/threats/technologies/statamic). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Statamic](https://junglewise.ai/threats/vendors/statamic).

## Quick answers

**Is CVE-2026-54243 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54243 being exploited in the wild.

**How severe is CVE-2026-54243?** Medium severity, with a CVSS score of 6.1, published 17 July 2026.

**Which products and versions are affected?** statamic/cms (Packagist) ECOSYSTEM:introduced=6.0.0,fixed=6.20.1; Statamic < 5.73.24, >= 6.0.0 < 6.20.1, < 5.73.24, >= 6.0.0, < 6.20.1.

**Is there a fix for CVE-2026-54243?** Yes. statamic/cms (Packagist): upgrade to 6.20.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54243 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-54243?** Check whether you run statamic/cms (Packagist) or Statamic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- statamic/cms (Packagist): upgrade to 6.20.1 or later

  ```sh
  composer require statamic/cms:^6.20.1
  ```


## Technical details

A CSV Injection (CWE-1236) vulnerability exists in Statamic's `src/Forms/Exporters/CsvExporter.php` component. The application fails to neutralize formula trigger characters (such as =, +, -, or @) in user-submitted form data before including them in CSV exports. An unauthenticated attacker can submit a form containing a malicious payload; when a privileged user exports these submissions and opens the file in a spreadsheet application, the payload is executed as a live formula. This can lead to information disclosure or limited data modification within the context of the spreadsheet application. The issue is resolved in versions 5.73.24 and 6.20.1.

## Affected products

- Statamic cms < 5.73.24, >= 6.0.0 < 6.20.1

## Identifiers

- CVE-2026-54243
- GHSA-h77m-qrj7-jxcw

## Timeline

- 2026-06-02: patched: Fixes merged into 5.x and 6.x branches
- 2026-06-03: advisory: GitHub Security Advisory GHSA-h77m-qrj7-jxcw published
- 2026-07-17: disclosed: CVE-2026-54243 published to NVD

## References

- [https://github.com/statamic/cms/commit/f17c098e52a92597fc5f81bd287700b3d05f4add](https://github.com/statamic/cms/commit/f17c098e52a92597fc5f81bd287700b3d05f4add)
- [https://github.com/statamic/cms/pull/14760](https://github.com/statamic/cms/pull/14760)
- [https://github.com/statamic/cms/releases/tag/v5.73.24](https://github.com/statamic/cms/releases/tag/v5.73.24)
- [https://github.com/statamic/cms/releases/tag/v6.20.1](https://github.com/statamic/cms/releases/tag/v6.20.1)
- [https://github.com/statamic/cms/security/advisories/GHSA-h77m-qrj7-jxcw](https://github.com/statamic/cms/security/advisories/GHSA-h77m-qrj7-jxcw)

## Related threats

- [Statamic CMS stored XSS in form notification email template](https://junglewise.ai/threats/cve-2026-71435-statamic-cms-stored-xss-in-form-notification-email-template)
- [Statamic CMS unrestricted file upload in frontend forms](https://junglewise.ai/threats/cve-2026-71434-statamic-cms-unrestricted-file-upload-in-frontend-forms)
- [Statamic CMS account takeover via OAuth email matching](https://junglewise.ai/threats/cve-2026-64665-statamic-cms-account-takeover-via-oauth-email-matching)
- [Statamic CMS missing authorization in Control Panel user wizard](https://junglewise.ai/threats/cve-2026-64664-statamic-cms-missing-authorization-in-control-panel-user-wizard)
- [Statamic CMS unsafe reflection in Antlers template resolution](https://junglewise.ai/threats/cve-2026-64663-statamic-cms-unsafe-reflection-in-antlers-template-resolution)