Description
wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or LibreOffice Calc.
Published: 2026-09-06
Score: 4.8 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 06 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Description wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or LibreOffice Calc.
Title wger before 2.6 CSV Formula Injection via member export
First Time appeared Wger
Wger wger
Weaknesses CWE-1236
CPEs cpe:2.3:a:wger:wger:*:*:*:*:*:*:*:*
Vendors & Products Wger
Wger wger
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}

Subscriptions

Wger Wger
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-06T12:00:30.969Z

Reserved: 2026-09-06T11:35:19.317Z

Link: CVE-2026-86257

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-06T12:17:16.700

Modified: 2026-09-06T12:17:16.700

Link: CVE-2026-86257

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses