CVE-2026-109396

4.2Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

4.2Medium

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: Required
Impact: Limited impact
Weakness: CWE-1236

Impact

Remote attackers can execute arbitrary spreadsheet formulas on an administrator's machine. They need an administrator to export and open user data containing crafted fields like registration, checkout, or newsletter inputs.

Root cause

The CSVSerializer class exports user-supplied values starting with =, +, -, or @ directly to CSV files without sanitization.

Affected systems

Thelia before 3.1.2 and 3.2.x before 3.2.1

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Fix & remediation

Upgrade Thelia to version 3.1.2 or 3.2.1. If patching must wait, instruct administrators not to open exported CSV files in spreadsheet applications like Excel without disabling formula execution.

shell

$ composer update thelia/thelia

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +, - or @ that CSVSerializer exports verbatim, executing formulas in the administrator's spreadsheet application.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109396