MEDIUM 4.8 NVD
CVE-2026-86257
wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas.
wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or LibreOffice Calc.
References
- https://github.com/wger-project/wger/security/advisories/GHSA-xq9m-hmp9-fw87
- https://www.vulncheck.com/advisories/wger-before-2.6-csv-formula-injection-via-member-expo
This medium severity vulnerability with a CVSS score of 4.8 was published on 2026-09-06 via NVD.
vulnfeed aggregates 10006 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.