CVE-2026-86257

    Dashboard / Vulnerabilities / CVE-2026-86257

    CVE-2026-86257

    Published: 6 Sept 2026Last Modified: 10 Sept 2026

    Summary: wger before 2.6 CSV Formula Injection via member export

    Details: wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or LibreOffice Calc.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86257.json, https://github.com/wger-project/wger/security/advisories/GHSA-xq9m-hmp9-fw87, https://nvd.nist.gov/vuln/detail/CVE-2026-86257, https://www.vulncheck.com/advisories/wger-before-2.6-csv-formula-injection-via-member-export

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -e1d70bcc38cd56ae4a254dca1713c404d069f319

    Affected versions

    2.5

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-86257 | CVE-DB