CVE-2025-31978
HCL BigFix Service Management (SM) does not adequately sanitize or safely render
- State
- Published
- Severity
- 4.6 Medium
- Published
- May 6, 2026
- Updated
- May 6, 2026
- Reserved
- Apr 1, 2025
Description
HCL BigFix Service Management (SM) does not adequately sanitize or safely render spreadsheet files (CSV, XLS, XLSX) before processing or distributing them. An attacker could populate data fields which, when saved to a CSV file, may attempt information exfiltration or other malicious activity when automatically executed by the spreadsheet software. Note that current versions of Excel warn users of untrusted content.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.6 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N | HCL |
Weaknesses
- CWE-201 Insertion of Sensitive Information Into Sent Data
Affected Products
| Product | Versions |
|---|---|
BigFix Service Management (SM)HCL Software |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.