medium5.4
CVE-2026-86257
wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas.
Impact
wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or LibreOffice Calc.
Affected products
| Product | Affected versions |
|---|---|
| Wger | before 2.6 |
Versions were read from the advisory text. No structured product data has been published for this record yet.