CWE-1236
AllowedImproper Neutralization of Formula Elements in a CSV File
Abstraction: Base · Status: Incomplete
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
419 vulnerabilities reference this CWE, most recent first.
GHSA-P9FF-8G3W-RCCV
Vulnerability from github – Published: 2026-08-03 03:31 – Updated: 2026-08-03 03:31BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. If a user downloads and opens a CSV file containing malicious code injected by an attacker, the malicious code may be executed.
{
"affected": [],
"aliases": [
"CVE-2026-65875"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-03T01:16:45Z",
"severity": "MODERATE"
},
"details": "BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. If a user downloads and opens a CSV file containing malicious code injected by an attacker, the malicious code may be executed.",
"id": "GHSA-p9ff-8g3w-rccv",
"modified": "2026-08-03T03:31:56Z",
"published": "2026-08-03T03:31:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65875"
},
{
"type": "WEB",
"url": "https://basercms.net/security/JVN_94952030"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/vu/JVNVU94952030"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-PH58-3QM4-JPWW
Vulnerability from github – Published: 2022-07-05 00:00 – Updated: 2022-07-14 00:00The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE
{
"affected": [],
"aliases": [
"CVE-2022-2268"
],
"database_specific": {
"cwe_ids": [
"CWE-1236",
"CWE-434",
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-07-04T13:15:00Z",
"severity": "HIGH"
},
"details": "The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE",
"id": "GHSA-ph58-3qm4-jpww",
"modified": "2022-07-14T00:00:19Z",
"published": "2022-07-05T00:00:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2268"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/578093db-a025-4148-8c4b-ec2df31743f7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PM8C-JGCW-6VJ7
Vulnerability from github – Published: 2024-07-16 18:31 – Updated: 2024-07-16 18:31A formula injection vulnerability exists in Tenable Identity Exposure where an authenticated remote attacker with administrative privileges could manipulate application form fields in order to trick another administrator into executing CSV payloads. - CVE-2024-3232
{
"affected": [],
"aliases": [
"CVE-2024-3232"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-16T17:15:11Z",
"severity": "HIGH"
},
"details": "A formula injection vulnerability exists in Tenable Identity Exposure where an authenticated remote attacker with administrative privileges could manipulate application form fields in order to trick another administrator into executing CSV payloads. - CVE-2024-3232",
"id": "GHSA-pm8c-jgcw-6vj7",
"modified": "2024-07-16T18:31:42Z",
"published": "2024-07-16T18:31:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3232"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/tns-2024-04"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PMF5-GX6H-8X53
Vulnerability from github – Published: 2022-05-13 01:18 – Updated: 2022-05-13 01:18CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the Server field in an HTTP response header, which is directly injected into a CSV report.
{
"affected": [],
"aliases": [
"CVE-2018-11652"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-06-01T15:29:00Z",
"severity": "CRITICAL"
},
"details": "CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the Server field in an HTTP response header, which is directly injected into a CSV report.",
"id": "GHSA-pmf5-gx6h-8x53",
"modified": "2022-05-13T01:18:57Z",
"published": "2022-05-13T01:18:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11652"
},
{
"type": "WEB",
"url": "https://github.com/sullo/nikto/commit/e759b3300aace5314fe3d30800c8bd83c81c29f7"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/44899"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PP2H-95HM-HV9R
Vulnerability from github – Published: 2021-08-30 16:13 – Updated: 2021-08-27 12:49Impact
Data Object CSV import allows formular injection.
Patches
Problem is patched in 10.1.1
Workarounds
Apply https://github.com/pimcore/pimcore/pull/9992.patch
References
https://cwe.mitre.org/data/definitions/1236.html
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "pimcore/pimcore"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-37702"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": true,
"github_reviewed_at": "2021-08-26T20:12:56Z",
"nvd_published_at": "2021-08-18T15:15:00Z",
"severity": "MODERATE"
},
"details": "### Impact\nData Object CSV import allows formular injection. \n\n### Patches\nProblem is patched in 10.1.1\n\n### Workarounds\nApply https://github.com/pimcore/pimcore/pull/9992.patch\n\n### References\nhttps://cwe.mitre.org/data/definitions/1236.html\n",
"id": "GHSA-pp2h-95hm-hv9r",
"modified": "2021-08-27T12:49:12Z",
"published": "2021-08-30T16:13:13Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-pp2h-95hm-hv9r"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37702"
},
{
"type": "WEB",
"url": "https://github.com/pimcore/pimcore/pull/9992"
},
{
"type": "PACKAGE",
"url": "https://github.com/pimcore/pimcore"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcore"
}
GHSA-PQFM-Q79F-GFXC
Vulnerability from github – Published: 2022-05-13 01:19 – Updated: 2024-03-21 03:33** DISPUTED ** CSV Injection (aka Excel Macro Injection or Formula Injection) in /lib/plugins/usermanager/admin.php in DokuWiki 2018-04-22a and earlier allows remote attackers to exfiltrate sensitive data and to execute arbitrary code via a value that is mishandled in a CSV export. NOTE: the vendor has stated "this is not a security problem in DokuWiki."
{
"affected": [],
"aliases": [
"CVE-2018-15474"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-09-07T22:29:00Z",
"severity": "CRITICAL"
},
"details": "** DISPUTED ** CSV Injection (aka Excel Macro Injection or Formula Injection) in /lib/plugins/usermanager/admin.php in DokuWiki 2018-04-22a and earlier allows remote attackers to exfiltrate sensitive data and to execute arbitrary code via a value that is mishandled in a CSV export. NOTE: the vendor has stated \"this is not a security problem in DokuWiki.\"",
"id": "GHSA-pqfm-q79f-gfxc",
"modified": "2024-03-21T03:33:32Z",
"published": "2022-05-13T01:19:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15474"
},
{
"type": "WEB",
"url": "https://github.com/splitbrain/dokuwiki/issues/2450"
},
{
"type": "WEB",
"url": "https://seclists.org/fulldisclosure/2018/Sep/4"
},
{
"type": "WEB",
"url": "https://www.patreon.com/posts/unfixed-security-21250652"
},
{
"type": "WEB",
"url": "https://www.sec-consult.com/en/blog/advisories/dokuwiki-csv-formula-injection-vulnerability"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PVJ2-28FW-3GC8
Vulnerability from github – Published: 2022-09-17 00:00 – Updated: 2022-09-18 00:00CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloads capable of executing system commands. Admin user exporting contacts in CSV file may end up executing the malicious system commands on his system.
{
"affected": [],
"aliases": [
"CVE-2022-38844"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-16T14:15:00Z",
"severity": "HIGH"
},
"details": "CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloads capable of executing system commands. Admin user exporting contacts in CSV file may end up executing the malicious system commands on his system.",
"id": "GHSA-pvj2-28fw-3gc8",
"modified": "2022-09-18T00:00:32Z",
"published": "2022-09-17T00:00:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38844"
},
{
"type": "WEB",
"url": "https://medium.com/cybersecurity-valuelabs/espocrm-7-1-8-is-vulnerable-to-csv-injection-4c07494e2a76"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PWPX-FV8F-9458
Vulnerability from github – Published: 2023-04-25 15:30 – Updated: 2024-04-04 03:40ChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and First Name input fields when creating a new person. These vulnerabilities allow attackers to execute arbitrary code via a crafted excel file.
{
"affected": [],
"aliases": [
"CVE-2023-25348"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-25T13:15:09Z",
"severity": "HIGH"
},
"details": "ChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and First Name input fields when creating a new person. These vulnerabilities allow attackers to execute arbitrary code via a crafted excel file.",
"id": "GHSA-pwpx-fv8f-9458",
"modified": "2024-04-04T03:40:28Z",
"published": "2023-04-25T15:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25348"
},
{
"type": "WEB",
"url": "https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-25348"
},
{
"type": "WEB",
"url": "https://github.com/ChurchCRM/CRM"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PX5R-QP49-693Q
Vulnerability from github – Published: 2026-04-14 15:30 – Updated: 2026-04-16 15:31An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to execute arbitrary code and escalate privileges via the CSV registration field
{
"affected": [],
"aliases": [
"CVE-2026-31049"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-14T14:16:13Z",
"severity": "CRITICAL"
},
"details": "An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to execute arbitrary code and escalate privileges via the CSV registration field",
"id": "GHSA-px5r-qp49-693q",
"modified": "2026-04-16T15:31:29Z",
"published": "2026-04-14T15:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31049"
},
{
"type": "WEB",
"url": "https://blog.hostbillapp.com/2025/12/03/hostbill-security-advisory"
},
{
"type": "WEB",
"url": "https://github.com/Muhammad5235/HostBill-CVEs-2025/blob/main/Missing%20Server-Side%20Validation/Registration%20fields%20%26%20Import%20Csv"
},
{
"type": "WEB",
"url": "https://hostbillapp.com/changelog"
},
{
"type": "WEB",
"url": "https://hostbillapp.com/release-notes/11-27-2025.html"
},
{
"type": "WEB",
"url": "https://hostbillapp.com/release-notes/12-01-2025.html"
},
{
"type": "WEB",
"url": "https://hostbillapp.com/responsible-disclosure"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-Q3Q6-3X37-G8GW
Vulnerability from github – Published: 2024-04-09 21:32 – Updated: 2026-04-08 18:32The Relevanssi – A Better Search plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 4.22.1. This makes it possible for unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
{
"affected": [],
"aliases": [
"CVE-2024-3214"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-09T19:15:40Z",
"severity": "MODERATE"
},
"details": "The Relevanssi \u2013 A Better Search plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 4.22.1. This makes it possible for unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.",
"id": "GHSA-q3q6-3x37-g8gw",
"modified": "2026-04-08T18:32:57Z",
"published": "2024-04-09T21:32:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3214"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3064304/relevanssi/tags/4.22.2/lib/log.php"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9960bae9-6f19-49eb-8f24-fdde4933671e?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
When generating CSV output, ensure that formula-sensitive metacharacters are effectively escaped or removed from all data before storage in the resultant CSV. Risky characters include '=' (equal), '+' (plus), '-' (minus), and '@' (at).
Mitigation
If a field starts with a formula character, prepend it with a ' (single apostrophe), which prevents Excel from executing the formula.
Mitigation
Certain implementations of spreadsheet software might disallow formulas from executing if the file is untrusted, or if the file is not authored by the current user.
No CAPEC attack patterns related to this CWE.