CVE-2026-54243 is a vulnerability in Statamic CMS where form submission values exported to CSV files are not properly neutralized for spreadsheet formula characters in versions prior to 5.73.24 and 6.20.1. This improper neutralization can cause spreadsheet applications to interpret certain cell values as executable formulas when a Control Panel user opens the CSV export. Since form submissions can be made by unauthenticated users, an attacker can inject malicious formula triggers that execute upon export viewing. The vulnerability is addressed by fixes in Statamic versions 5.73.24 and 6.20.1.

An attacker can supply malicious input via form submissions that, when exported to CSV and opened by an editor in a spreadsheet application, may be interpreted as live formulas. This can lead to potential formula injection risks such as data manipulation or code execution within the spreadsheet context. The vulnerability requires user interaction to open the exported CSV and does not allow direct remote code execution on the server. The CVSS score is 6.1 (medium severity), reflecting the need for user interaction and limited scope of impact.

Upgrade Statamic CMS to version 5.73.24 or later, or 6.20.1 or later, where this issue is fixed. No other specific mitigations are indicated. Patch status is confirmed by the vendor advisory stating the fix is included in these versions.