CVE-2026-54243

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, form submission values in src/Forms/Exporters/CsvExporter.php were not neutralized for spreadsheet formula characters when exported to CSV. A submission containing a value beginning with a formula trigger character, such as =, +, -, or @, could be interpreted as a live formula when a Control Panel user opens the export in a spreadsheet application. Form submissions can come from unauthenticated front-end visitors, so the malicious value can be supplied by an anonymous user and is later triggered by an editor opening the export. This issue is fixed in versions 5.73.24 and 6.20.1.

• CWE-1236

• https://github.com/statamic/cms/commit/f17c098e52a92597fc5f81bd287700b3d05f4add
• https://github.com/statamic/cms/pull/14760
• https://github.com/statamic/cms/releases/tag/v5.73.24
• https://github.com/statamic/cms/releases/tag/v6.20.1
• https://github.com/statamic/cms/security/advisories/GHSA-h77m-qrj7-jxcw

Published

Jul 17, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54236vLLM is an inference and serving engine for large language m…5.3
• CVE-2026-54237Wavelog is web-based amateur radio logging software. From 1.…9.3
• CVE-2026-54239Faust.js is a headless WordPress toolkit. Prior to 1.8.11, t…8.8
• CVE-2026-54240libde265 is an open source implementation of the h.265 video…7.4
• CVE-2026-54241libde265 is an open source implementation of the h.265 video…7.4
• CVE-2026-54242Statamic is a Laravel and Git powered content management sys…4.9
• CVE-2026-54244Statamic is a Laravel and Git powered content management sys…3.5
• CVE-2026-54245Fleet is an open-source device management platform built on …7.6
• CVE-2026-54246Skipper is an HTTP router and reverse proxy for service comp…5.7
• CVE-2026-54247Skipper is an HTTP router and reverse proxy for service comp…4.3
• CVE-2026-54248Doco-CD is a GitOps continuous delivery tool that automatica…6.5
• CVE-2026-54249Pydantic AI is a Python agent framework for building Generat…6.8