CVE-2026-86257
4.8
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Summary
wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or LibreOffice Calc.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| wger-project | wger | 0 < 2.6 | affected |
| wger-project | wger | 2.6 | unaffected |
Weaknesses
- CWE-1236: Improper Neutralization of Formula Elements in a CSV File
References
- https://github.com/wger-project/wger/security/advisories/GHSA-xq9m-hmp9-fw87
- https://www.vulncheck.com/advisories/wger-before-2.6-csv-formula-injection-via-member-export
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.