CVE-2026-109396
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spr
CVSS
4.2
Média
EPSS
0.2%
p14
KEV
—
Exploit Today
4
0-100
Publicado: 12 de out. de 2026 · Última mod.: 13 de out. de 2026 · CWE-1236
0.2%EPSS · 30 dias0.2%
2026-10-132026-11-06
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +, - or @ that CSVSerializer exports verbatim, executing formulas in the administrator's spreadsheet application.
- github.comhttps://github.com/thelia/thelia/blob/3.2.0/core/lib/Thelia/Core/Serializer/Serializer/CSVSerializer.php
- github.comhttps://github.com/thelia/thelia/commit/6e46059225d87565caf4859ec0f764354e82ce95
- github.comhttps://github.com/thelia/thelia/commit/c00a26f0631ed9de3c4466176db6e808a25034aa
- github.comhttps://github.com/thelia/thelia/releases/tag/3.1.2
- github.comhttps://github.com/thelia/thelia/releases/tag/3.2.1
- github.comhttps://github.com/thelia/thelia/security/advisories/GHSA-gcgv-f8rf-w2wc
- www.vulncheck.comhttps://www.vulncheck.com/advisories/thelia-before-3.1.2-and-3.2-x-before-3.2.1-csv-formula-injection-via-exports
- github.comhttps://github.com/thelia/thelia/security/advisories/GHSA-gcgv-f8rf-w2wc
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-111038—28.5%
——9CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform. The vulnerability arises because certain user-controlled data, such as event names or templates within the Tenders module, are not properly validated or sanitised before being included in CSV files generated by the application. An attacker with low privileges can input specially crafted values that begin with characters interpreted as formulas by spreadsheet applications. When a victim downloads and opens the generated file in a compatible client, the content may be interpreted as a formula, potentially leading to unauthorised actions such as the execution of commands via mechanisms such as DDE, access to information, or interaction with system resources under the victim’s context.3dCVE-2026-1166484.1 MÉD11.0%
——3Tanium addressed an improper output sanitization vulnerability in Discover.6hCVE-2026-1214335.4 MÉD9.8%
——3AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist formula-prefixed metadata via bulk media import. Attackers can import crafted titles, artists, or custom fields through /api/station/{station_id}/files/bulk so formulas evaluate when other users open exported CSVs in spreadsheets.3dCVE-2026-671877.1 ALT6.6%
——2Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NF_Abstracts_List falls through to a validate() method that only checks required-field presence. Attackers can submit crafted formula payloads through the unauthenticated nf_ajax_submit endpoint that bypass CSV escaping applied only to Textbox and Textarea fields, resulting in CSV injection when an administrator downloads and opens the exported submissions file.2dCVE-2026-102799—21.5%
——6Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.167hCVE-2026-1166497.1 ALT10.2%
——3Tanium addressed an improper output sanitization vulnerability in Enforce.2d