CVE-2026-109396
Received Received - Intake

CSV Formula Injection in Thelia E-Commerce Platform

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +, - or @ that CSVSerializer exports verbatim, executing formulas in the administrator's spreadsheet application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109396
EUVD
EUVD-2026-97493

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Thelia Thelia 0
Thelia Thelia 3.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1236 The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a CSV formula injection flaw in Thelia versions before 3.1.2 and 3.2.x before 3.2.1. Attackers can inject spreadsheet formulas into CSV exports by submitting crafted registration, checkout, or newsletter fields starting with =, +, - or @. When an administrator opens the exported CSV in a spreadsheet application, the embedded formula executes, potentially leading to data exfiltration or command execution.

Detection Guidance

To detect CSV formula injection attempts, monitor for user-submitted fields starting with =, +, - or @ in registration, checkout or newsletter forms. Check exported CSV files for these patterns in customer names, addresses or phone numbers. Use grep to scan web server logs for such inputs: grep -rE '^[=+\-@]' /var/log/apache2/ or /var/log/nginx/

Impact Analysis

If you use Thelia versions before 3.1.2 or 3.2.x before 3.2.1, unauthenticated attackers could inject malicious formulas into CSV exports. When you open these files in spreadsheet software, the formulas may execute, potentially stealing sensitive data or running unauthorized commands on your system.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's security requirements for safeguarding protected health information. Organizations using vulnerable Thelia versions may face compliance violations if sensitive data is compromised through this flaw.

Mitigation Strategies

Upgrade Thelia to version 3.1.2 or 3.2.1 immediately. If upgrading is not possible, apply the patches from commits c00a26f or 6e46059. Review and sanitize all user-submitted data in registration, checkout and newsletter forms to block inputs starting with =, +, - or @. Disable dynamic content in spreadsheet applications for CSV files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109396. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart