The wger gym member TSV export endpoint writes user profile fields first_name and last_name directly into TSV cells without sanitizing formula prefixes. This allows any gym member to inject spreadsheet formulas into their profile fields, which execute when a gym admin exports and opens the member list in Excel, LibreOffice Calc, or Google Sheets. The executed formulas can exfiltrate data or, on legacy Excel with DDE enabled, execute arbitrary code locally. This vulnerability affects wger versions prior to 2.6 and has a high severity rating (CVSS 7.4).