Unrated severityNVD Advisory· Published Sep 6, 2026
wger before 2.6 CSV Formula Injection via member export
CVE-2026-86257
Description
wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or LibreOffice Calc.
Affected products
1- Range: <2.6
Patches
Vulnerability mechanics
References
2- github.com/wger-project/wger/security/advisories/GHSA-xq9m-hmp9-fw87mitrevendor-advisory
- www.vulncheck.com/advisories/wger-before-2.6-csv-formula-injection-via-member-exportmitrethird-party-advisory
News mentions
0No linked articles in our index yet.