CVE-2026-12862
XLSX formula injection in exports
- State
- Published
- Severity
- 5.1 Medium
- Published
- Jun 22, 2026
- Updated
- Jun 22, 2026
- Reserved
- Jun 22, 2026
Description
Untrusted user data was passed verbatim to Excel exports for administrators. This allowed formula injection which can be used to compromise the environment of the user loading the file or other data in the file.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N | rami.io |
Weaknesses
- CWE-148 Improper neutralization of input leaders
Affected Products
| Product | Versions |
|---|---|
Venuelesspretix |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.