CVE-2026-89246
Received Received - Intake

CSV Formula Injection in AVideo via myComments.download.php

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: VulnCheck

Description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV formula injection vulnerability in the myComments.download.php endpoint that fails to sanitize spreadsheet formula prefixes in comment text. Authenticated users can inject formulas starting with =, +, -, or @ characters that execute when administrators or video owners open the exported CSV file in spreadsheet applications.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89246
EUVD
EUVD-2026-76058

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wwbn avideo *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1236 The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a CSV formula injection vulnerability in WWBN AVideo. Authenticated users can inject spreadsheet formulas (starting with =, +, -, or @) into comment text via the myComments.download.php endpoint. When administrators or video owners open the exported CSV file in spreadsheet software, these formulas may execute locally.

Detection Guidance

To detect this vulnerability, inspect CSV export files for formula prefixes like =, +, -, or @ in comment text. Check AVideo's myComments.download.php and other CSV endpoints for unsanitized user input. Review logs for suspicious comment submissions containing these characters.

Impact Analysis

The vulnerability allows attackers to execute arbitrary formulas in the victim's spreadsheet application when they open a malicious CSV file. This could lead to local command execution, such as opening a calculator or other unintended actions, but does not provide further system access.

Mitigation Strategies

Immediately update AVideo to the latest patched version if available. Sanitize user input in comment fields to strip formula prefixes before storage. Modify CSV export functions to encode or remove formula characters. Restrict CSV export functionality to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89246. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart