CVE-2026-86257

Summary

wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or LibreOffice Calc.

Affected Software

VendorProductVersion RangeStatus
wger-projectwger0 < 2.6affected
wger-projectwger2.6unaffected

Weaknesses

  • CWE-1236: Improper Neutralization of Formula Elements in a CSV File

References