Security Advisory
CVE-2026-86257
CVSS 5.4
MEDIUM
Vulnerability Description
wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or LibreOffice Calc.
Published Date
2026-09-06T12:17:16.700
Data Feed
NIST National Vulnerability Database