CVE-2026-86257: wger before 2.6 CSV Formula Injection via member export
wger before 2.6 fails to sanitize firstname and lastname fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or LibreOffice Calc.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
wger versions before 2.6 are affected. Installations running 2.6 or later are not identified as affected by the provided information.
What access does an attacker need?
The attacker needs to be a gym member and able to supply a malicious first_name or last_name value. Exploitation also requires an administrator to export the member TSV data and open it in Excel or LibreOffice Calc.
What is the likely impact when exploitation succeeds?
A malicious spreadsheet formula can exfiltrate administrator data or execute code when the exported file is opened. The reported impact includes low confidentiality and integrity impact, with no availability impact.