CVE-2026-109396: Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports

Q: Which installations require remediation?

Thelia versions before 3.1.2 and versions in the 3.2.x branch before 3.2.1 are affected. Upgrading to 3.1.2 or 3.2.1, as applicable to the deployed branch, addresses the affected versions.

Q: What must happen for exploitation to have an effect?

An unauthenticated visitor must submit crafted registration, checkout, or newsletter field values beginning with =, +, -, or @. An administrator must then export the data to CSV and open it in a spreadsheet application that evaluates the injected formula.

Q: Are public-facing stores exposed by default?

Stores that allow visitors to submit registration, checkout, or newsletter data can receive the crafted values without attacker authentication. The formula is triggered only when the affected CSV export is opened in an administrator's spreadsheet application.

Q: How can administrators check for possible malicious submissions?

Review registration, checkout, and newsletter records that may be included in CSV exports for name, address, phone, or other submitted values starting with =, +, -, or @. Treat matching values as potentially malicious before exporting or opening them in spreadsheet software.

Published Oct 12, 2026

Updated

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +, - or @ that CSVSerializer exports verbatim, executing formulas in the administrator's spreadsheet application.

Affected Software

1 affected component

Thelia Thelia<3.1.2, >=3.2.0<3.2.1

Event History

Oct 12, 2026

CVE Published

via MITRE·03:16 PM

Data Sourced

via MITRE·03:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations require remediation?

Thelia versions before 3.1.2 and versions in the 3.2.x branch before 3.2.1 are affected. Upgrading to 3.1.2 or 3.2.1, as applicable to the deployed branch, addresses the affected versions.

What must happen for exploitation to have an effect?

An unauthenticated visitor must submit crafted registration, checkout, or newsletter field values beginning with =, +, -, or @. An administrator must then export the data to CSV and open it in a spreadsheet application that evaluates the injected formula.

Are public-facing stores exposed by default?

Stores that allow visitors to submit registration, checkout, or newsletter data can receive the crafted values without attacker authentication. The formula is triggered only when the affected CSV export is opened in an administrator's spreadsheet application.

How can administrators check for possible malicious submissions?

Review registration, checkout, and newsletter records that may be included in CSV exports for name, address, phone, or other submitted values starting with =, +, -, or @. Treat matching values as potentially malicious before exporting or opening them in spreadsheet software.

CVE-2026-109396: Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports

Affected Software

Event History

Frequently Asked Questions

Which installations require remediation?

What must happen for exploitation to have an effect?

Are public-facing stores exposed by default?

How can administrators check for possible malicious submissions?

Company

Resources

Contact

Frequently Asked Questions

Which installations require remediation?

What must happen for exploitation to have an effect?

Are public-facing stores exposed by default?

How can administrators check for possible malicious submissions?