CVE-2026-86257: Improper Neutralization of Formula Elements in a CSV File in wger-project wger

The vulnerability CVE-2026-86257 affects wger versions prior to 2.6. It involves improper neutralization of formula elements in CSV/TSV exports, specifically in the first_name and last_name fields of gym member data. Because these fields are not sanitized, an attacker can inject malicious spreadsheet formulas such as =HYPERLINK. When an admin opens the exported file, these formulas may execute, enabling exfiltration of admin data or execution of code. The CVSS 4.8 score reflects a medium severity with network attack vector, low attack complexity, and limited privileges required.

Attackers with gym member access can inject malicious spreadsheet formulas into exported TSV files. If an administrator opens these files in vulnerable spreadsheet software, the formulas may execute, potentially exposing sensitive admin data or enabling code execution. This could lead to unauthorized data disclosure or further compromise of the administrative environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid opening exported TSV files from untrusted or unverified gym members in spreadsheet applications that support formula execution. Consider sanitizing or validating exported data manually before opening.