CVE-2026-86257
Received Received - Intake

wger Gym Member TSV Export Formula Injection

Publication date: 2026-09-06

Last updated on: 2026-09-06

Assigner: VulnCheck

Description
wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or LibreOffice Calc.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-06
Last Modified
2026-09-06
Generated
2026-09-06
AI Q&A
2026-09-06
EPSS Evaluated
N/A
NVD
CVE-2026-86257
EUVD
EUVD-2026-72113

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wger wger to 2.6 (exc)
wger wger to 2.5.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1236 The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-86257 is a CSV/TSV formula injection vulnerability in the wger gym management software. It affects versions up to 2.5.0 where the TSV export endpoint fails to sanitize first_name and last_name fields. Attackers can inject spreadsheet formulas like =HYPERLINK into these fields. When a gym administrator exports the member list and opens the file in Excel or LibreOffice Calc, the formula executes, potentially exfiltrating data or executing code.

Detection Guidance

Check if your wger instance is running a vulnerable version (up to 2.5.0) by inspecting the version in the admin panel or via API. Look for suspicious entries in the gym member export where first_name or last_name fields contain spreadsheet formulas like =HYPERLINK or other formula triggers.

Impact Analysis

If you are a gym administrator using wger versions before 2.6, opening an exported TSV file could trigger malicious formulas. This may lead to data exfiltration of sensitive member information or arbitrary code execution on your local machine if using legacy Excel with DDE enabled. The attack requires no special privileges beyond being a gym member.

Compliance Impact

This vulnerability could lead to unauthorized data exfiltration, violating GDPR's data protection principles or HIPAA's confidentiality requirements. If sensitive member data is leaked due to this flaw, organizations may face compliance breaches, regulatory fines, and reputational damage.

Mitigation Strategies

Upgrade wger to version 2.6 or later immediately. If upgrading is not possible, sanitize the first_name and last_name fields by prefixing formula-triggering characters (like =, +, -, @) with a single quote in the export functionality. Restrict access to the member export feature to trusted administrators only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86257. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart