Statamic, a Laravel‑based CMS, stored form submission data to CSV without sanitizing spreadsheet formula characters. An attacker could submit a value beginning with a formula trigger such as =, +, -, or @. When an editor later opens the exported CSV in a spreadsheet application, the application will treat the value as a live formula and could execute it. This flaw permits formula injection that can affect applications that evaluate spreadsheet formulas.

All installations of Statamic CMS running a version earlier than 5.73.24 for the v5 line or earlier than 6.20.1 for the v6 line are potentially vulnerable, regardless of the particular form or data content, because the export code does not neutralize spreadsheet formula characters.

The vulnerability has a CVSS score of 6.1, indicating moderate severity. Its EPSS score is below 1%, suggesting a very low likelihood of exploitation in the wild, and it is not currently listed in the CISA KEV catalog. The attack path requires an unauthenticated user to inject the malicious value through a form, and a separate authenticated editor must later open the generated CSV file in a spreadsheet program for the injection to take effect. Because these conditions must be met, the practical risk is moderate but depends on the exposure of the CSV export to attackers and the use of applications that evaluate spreadsheet formulas.