Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, form submission values in src/Forms/Exporters/CsvExporter.php were not neutralized for spreadsheet …
Medium CVSS 6.1
Summary
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, form submission values in src/Forms/Exporters/CsvExporter.php were not neutralized for spreadsheet formula characters when exported to CSV. A submission containing a value beginning with a formula trigger character, such as =, +, -, or @, could be interpreted as a live formula when a Control Panel user opens the export in a spreadsheet application. Form submissions can come from unauthenticated f…
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/statamic/cms/commit/f17c098e52a92597fc5f81bd287700b3d05f4add
- https://github.com/statamic/cms/pull/14760
- https://github.com/statamic/cms/releases/tag/v5.73.24
- https://github.com/statamic/cms/releases/tag/v6.20.1
- https://github.com/statamic/cms/security/advisories/GHSA-h77m-qrj7-jxcw
Timeline
- nvd_ingest NVD