CVE-2026-89246: Improper Neutralization of Formula Elements in a CSV File in WWBN AVideo
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV formula injection vulnerability in the myComments.download.php endpoint that fails to sanitize spreadsheet formula prefixes in comment text. Authenticated users can inject formulas starting with =, +, -, or @ characters that execute when administrators or video owners open the exported CSV file in spreadsheet applications.
AI Analysis
Technical Summary
WWBN AVideo, through commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a CSV formula injection vulnerability in the myComments.download.php endpoint. The application fails to sanitize spreadsheet formula prefixes in comment text, allowing authenticated users to inject formulas starting with =, +, -, or @ characters. These formulas execute when the exported CSV file is opened in spreadsheet applications by administrators or video owners.
Potential Impact
An attacker with authenticated access can inject malicious spreadsheet formulas into comments. When administrators or video owners open the exported CSV file, these formulas execute, potentially leading to unintended actions or data exposure within spreadsheet applications. The vulnerability is rated medium severity with a CVSS score of 5.1.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the myComments.download.php endpoint to trusted users only and avoid opening exported CSV files in spreadsheet applications without prior sanitization.
CVE-2026-89246: Improper Neutralization of Formula Elements in a CSV File in WWBN AVideo
Description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV formula injection vulnerability in the myComments.download.php endpoint that fails to sanitize spreadsheet formula prefixes in comment text. Authenticated users can inject formulas starting with =, +, -, or @ characters that execute when administrators or video owners open the exported CSV file in spreadsheet applications.
CVSS v4.0
Score 5.1medium
Affected software
WWBN
AVideo
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
WWBN AVideo, through commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a CSV formula injection vulnerability in the myComments.download.php endpoint. The application fails to sanitize spreadsheet formula prefixes in comment text, allowing authenticated users to inject formulas starting with =, +, -, or @ characters. These formulas execute when the exported CSV file is opened in spreadsheet applications by administrators or video owners.
Potential Impact
An attacker with authenticated access can inject malicious spreadsheet formulas into comments. When administrators or video owners open the exported CSV file, these formulas execute, potentially leading to unintended actions or data exposure within spreadsheet applications. The vulnerability is rated medium severity with a CVSS score of 5.1.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the myComments.download.php endpoint to trusted users only and avoid opening exported CSV files in spreadsheet applications without prior sanitization.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-11T10:51:31.663Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aa3e6de91cc7f38481866bb
Added to database: 09/11/2026, 11:32:46 UTC
Last enriched: 09/11/2026, 11:48:08 UTC
Last updated: 09/11/2026, 20:12:41 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.