CVE-2026-86257 — wger before 2.6 CSV Formula Injection via member export
wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can in…
Published: 2026-09-06 · CVSS: 4.8 · CVSS 4.0
wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or LibreOffice Calc.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7