EUVD-2026-45321
GHSA-h77m-qrj7-jxcw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
PR:N reflects unauthenticated form submission delivery; UI:R and S:C model the required editor action and out-of-scope spreadsheet impact; A:N as server availability is unaffected.
Primary rating from Vendor (https://github.com/statamic/cms).
CVSS VectorVendor: https://github.com/statamic/cms
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
Impact
Form submission values were not neutralized for spreadsheet formula characters when exported to CSV. A submission containing a value beginning with a formula trigger character (e.g. = , + , - , @ ) could be interpreted as a live formula when a Control Panel user opens the export in a spreadsheet application. Form submissions can come from unauthenticated front-end visitors, so the malicious value can be supplied by an anonymous user and is later triggered by an editor opening the export.
Exploitation affects the spreadsheet application used to open the export, not the Statamic application or server; the data at risk is the form submission data the exporting user is already authorized to view.
Patches
This has been fixed in 5.73.24 and 6.20.1.
AnalysisAI
CSV formula injection in Statamic CMS allows an unauthenticated front-end visitor to plant spreadsheet formula payloads via public form submissions that execute when a Control Panel editor exports and opens those submissions in a spreadsheet application. Affected versions span the entire v5 branch below 5.73.24 and v6 branch from 6.0.0 below 6.20.1; vendor-released patches exist for both. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the attack structure is well-understood and requires no specialized tooling given the unauthenticated submission vector.
Technical ContextAI
CWE-1236 (Improper Neutralization of Formula Elements in a CSV File) describes the root cause: user-supplied input containing formula trigger characters (=, +, -, @, tab, newline) is written verbatim into CSV output without a defensive prefix such as a leading apostrophe or tab-escape. Statamic CMS is a Laravel-based flat-file PHP CMS distributed as the Composer package statamic/cms (CPE: pkg:composer/statamic_cms). Its Control Panel provides form submission management including a CSV export feature. Because form submissions originate from unauthenticated front-end visitors, no authentication barrier exists at the injection point. The spreadsheet application - not the Statamic server - is responsible for evaluating the injected formula, making this a stored client-side attack: the payload is inert on the server and activates only inside the victim's spreadsheet application (e.g., Microsoft Excel, LibreOffice Calc) upon file open.
RemediationAI
The primary remediation is to upgrade Statamic CMS to version 5.73.24 (v5 branch) or 6.20.1 (v6 branch), as confirmed by the vendor advisory at https://github.com/statamic/cms/security/advisories/GHSA-h77m-qrj7-jxcw. If immediate upgrade is not feasible, restrict the CSV export feature in the Control Panel to the smallest possible set of trusted administrators, reducing the population of users who could trigger a planted payload. As a client-side compensating control, instruct editors to open CSV exports with external content and dynamic data connections disabled - in Microsoft Excel this is under File > Options > Trust Center > Trust Center Settings > External Content; note this is a per-user setting that cannot be enforced server-side and provides no protection against DDE payloads on older Excel versions. Disabling public-facing forms entirely eliminates the injection delivery channel but has obvious functional trade-offs. Upgrade remains the only reliable fix.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today