Sign in
Deutsch English Español Polski
Medium

Statamic Vulnerable to CSV formula injection in form submission exports

  • Disclosed: 26.06.2026
  • Updated: 11.10.2026 10:22

Impact

Form submission values were not neutralized for spreadsheet formula characters when exported to CSV. A submission containing a value beginning with a formula trigger character (e.g.  = ,  + ,  - ,  @ ) could be interpreted as a live formula when a Control Panel user opens the export in a spreadsheet application. Form submissions can come from unauthenticated front-end visitors, so the malicious value can be supplied by an anonymous user and is later triggered by an editor opening the export.

Exploitation affects the spreadsheet application used to open the export, not the Statamic application or server; the data at risk is the form submission data the exporting user is already authorized to view.

Patches

This has been fixed in 5.73.24 and 6.20.1.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package statamic/cms >= 6.0.0, < 6.20.1, < 5.73.24 6.20.1, 5.73.24

References

CVSS score 6.1/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE)
CWE-1236
Platform
Composer
Package
statamic/cms
Disclosed
26.06.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-h77m-qrj7-jxcw - CC BY 4.0

Vulnerability history: statamic/cms

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (44) in the archive
Total entries
44
First → latest
03.2022 08.2026
Without a fix
1
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 15
  • Medium 25
  • Low 3

Disclosures per year

Severity:
  1. Statamic: Account takeover via OAuth email matching without email-verification check
    High · 8.1 CVE-2026-64665 < 5.74.1, >= 6.0.0, < 6.24.0 5.74.1, 6.24.0
  2. Statamic Vulnerable to CSV formula injection in form submission exports this entry
    Medium · 6.1 CVE-2026-54243 >= 6.0.0, < 6.20.1, < 5.73.24 6.20.1, 5.73.24
  3. Statamic CMS's unsafe method invocation via collection sorting allows data destruction
    High · 7.4 CVE-2026-49287 < 5.73.23, >= 6.0.0, < 6.20.0 5.73.23, 6.20.0
  4. Statamic: Unsafe method invocation via query value resolution allows data destruction
    High · 8.1 CVE-2026-41175 < 5.73.20, >= 6.0.0-alpha.1, < 6.13.0 5.73.20, 6.13.0
  5. Statamic has Stored XSS via SVG Sanitization Bypass
    High · 8.7 CVE-2026-33172 >= 6.0.0-alpha.1, < 6.7.0, < 5.73.14 6.7.0, 5.73.14
  6. Statamic vulnerable to privilege escalation via stored cross-site scripting
    High · 8.7 CVE-2026-28426 < 5.73.11, >= 6.0.0-alpha.1, < 6.4.0 5.73.11, 6.4.0
  7. Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs
    High · 8.0 CVE-2026-28425 < 5.73.16, >= 6.0.0-alpha.1, < 6.7.2 5.73.16, 6.7.2
  8. Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass
    High · 8.8 CVE-2026-27939 >= 6.0.0, < 6.4.0 6.4.0
  9. Statamic is vulnerable to account takeover via password reset link injection
    Critical · 9.3 CVE-2026-27593 < 5.73.10, >= 6.0.0-alpha.1, < 6.7.1 5.73.10, 6.7.1
  10. Statamic affected by privilege escalation via stored cross-site scripting
    High · 8.1 CVE-2026-27196 >= 6.0.0-alpha.1, < 6.3.2, < 5.73.9 6.3.2, 5.73.9
  11. Statamic CMS vulnerable to privilege escalation via stored cross-site scripting
    High · 8.7 CVE-2026-25759 >= 6.0.0, < 6.2.3 6.2.3
  12. Statamic Vulnerable to Superadmin Account Takeover via Stored Cross-Site Scripting and Lack of Proper X-CSRF-TOKEN Server-Side Validation
    High · 8.0 CVE-2025-64112 < 5.22.1 5.22.1
  13. Statmic CMS vulnerable to account takeover via XSS and password reset link
    High · 8.2 CVE-2024-24570 >= 4.00, < 4.46.0, < 3.4.17 4.46.0, 3.4.17
  14. Cross-site Scripting via uploaded assets
    High · 7.5 CVE-2023-48701 < 3.4.15, >= 4.0.0, < 4.36.0 3.4.15, 4.36.0
  15. Statamic CMS vulnerable to remote code execution via form uploads
    High · 8.8 CVE-2023-48217 >= 4.0.0, < 4.34.0, < 3.4.14 4.34.0, 3.4.14
  16. Statamic CMS remote code execution via front-end form uploads
    High · 8.3 CVE-2023-47129 >= 4.0.0, < 4.33.0, < 3.4.13 4.33.0, 3.4.13
  17. Statamic framework Incorrect Permission Assignment
    High · 8.8 CVE-2017-11422 < 2.6.0 2.6.0

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.