CVE-2026-111038: Multiple vulnerabilities in Coupa’s Total Spend Management Platform
CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform. The vulnerability arises because certain user-controlled data, such as event names or templates within the Tenders module, are not properly validated or sanitised before being included in CSV files generated by the application. An attacker with low privileges can input specially crafted values that begin with characters interpreted as formulas by spreadsheet applications. When a victim downloads and opens the generated file in a compatible client, the content may be interpreted as a formula, potentially leading to unauthorised actions such as the execution of commands via mechanisms such as DDE, access to information, or interaction with system resources under the victim’s context.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of the Coupa Supplier Portal who download CSV exports containing attacker-controlled data from the Tenders module are exposed when they open those files in a compatible spreadsheet application. The impact occurs in the context of the user opening the export.
What does an attacker need to exploit the vulnerability?
An attacker needs low-privileged access that allows them to supply crafted values, such as event names or templates in the Tenders module. Exploitation also requires a victim to download and open a generated CSV file in a spreadsheet client that interprets the value as a formula.
Is user interaction required?
Yes. A victim must download and open the generated CSV file in a compatible spreadsheet application. The attack depends on that application interpreting the injected content as a formula.