CVE-2026-129133: MRBS before 1.13.0 CSV Formula Injection via Report Export
MRBS before 1.13.0 contains a CSV formula injection vulnerability that allows authenticated users to inject spreadsheet formulas because the escape() function in web/report.php fails to neutralize leading formula characters. Attackers can store formulas in booking names, descriptions or custom fields that execute when privileged users open exported CSV reports, enabling data exfiltration or command execution via DDE.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MRBSto a version that resolves this vulnerability.Fixed in 1.13.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
MRBS deployments running versions before 1.13.0 are affected when authenticated users can create or modify booking names, descriptions, or custom fields and a privileged user exports and opens a CSV report.
What does an attacker need to exploit it?
The attacker needs authenticated access to enter a spreadsheet formula into a booking-related field. Exploitation also requires a privileged user to open an exported CSV report containing the attacker-controlled value.
Are systems affected merely by running the vulnerable version?
A vulnerable MRBS version alone does not trigger the issue. The attack path depends on user-controlled booking data being included in a CSV report that is opened in spreadsheet software.
What should be prioritized if an immediate upgrade is not possible?
Until upgrading to 1.13.0, restrict who can create or edit booking names, descriptions, and custom fields, and avoid opening CSV reports containing untrusted booking data. Review exported report data for formula-like leading characters before opening it in spreadsheet software.
How can administrators check for possible exploitation?
Review booking names, descriptions, and custom fields for values beginning with spreadsheet formula characters, particularly in records included in CSV exports. Also identify whether privileged users have exported and opened reports containing attacker-controlled booking data.