CVE-2026-124591
Deferred Deferred - Pending Action

CSV Injection in Bahleel via CsvExporter

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: VulDB

Description
A vulnerability was detected in Bahleel 0.1.0/0.1.1. Affected is the function fputcsv of the file app/Exporters/CsvExporter.php. The manipulation results in csv injection. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-124591
EUVD
EUVD-2026-119979

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
n/a Bahleel 0.1.0
n/a Bahleel 0.1.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1236 The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-124591 is a CSV injection vulnerability in Bahleel 0.1.0/0.1.1. The issue occurs in the CsvExporter component where the fputcsv function does not sanitize formula prefixes like '=' in CSV data. When exported CSV files are opened in spreadsheet software, formulas may execute unintended actions such as outbound requests or command execution.

Detection Guidance

To detect this vulnerability, inspect CSV files exported by Bahleel for formula prefixes like '=' or other formula indicators. Check the app/Exporters/CsvExporter.php file for unsanitized use of fputcsv(). Review database entries for stored data containing formula payloads.

Impact Analysis

If you use Bahleel to export data containing attacker-controlled input, opening the CSV file in spreadsheet software could lead to unintended actions. This includes making requests to attacker servers or executing arbitrary commands, depending on the spreadsheet application's settings and formula evaluation capabilities.

Mitigation Strategies

Immediately update Bahleel to a patched version if available. If not, sanitize CSV output by removing formula prefixes before export. Implement input validation to block formula payloads in stored data. Disable formula evaluation in spreadsheet software.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124591. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...