Medium severity5.4NVD Advisory· Published Sep 6, 2026· Updated Sep 8, 2026

CVE-2026-86257

Description

wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or LibreOffice Calc.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Wger Project/Wgerllm-fuzzy
Range: <2.6

Patches

Vulnerability mechanics

References

github.com/wger-project/wger/security/advisories/GHSA-xq9m-hmp9-fw87nvd
www.vulncheck.com/advisories/wger-before-2.6-csv-formula-injection-via-member-exportnvd

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000