CVE-2026-109396GHSA-gcgv-f8rf-w2wc
Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports
Thelia Thelia
CVSS
2.3LowExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 13 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.19%Chance of exploitation activity in the next 30 days, higher than 8% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +, - or @ that CSVSerializer exports verbatim, executing formulas in the administrator's spreadsheet application.
Text from CVE List
Affected versions 2
- Theliaaffected: all versions before 3.1.2CVE List
- Theliaaffected: 3.2.0 before 3.2.1CVE List
References 7
- github.com/thelia/thelia/commit/c00a26f0631ed9de3c4466176db6e808a25034aaFixvia CVE List
- github.com/thelia/thelia/commit/6e46059225d87565caf4859ec0f764354e82ce95Fixvia CVE List
- github.com/thelia/thelia/releases/tag/3.1.2Fixvia CVE List
- github.com/thelia/thelia/releases/tag/3.2.1Fixvia CVE List
- vulncheck.com/advisories/thelia-before-3.1.2-and-3.2-x-before-3.2.1-csv-formula-injection-via-exportsAdvisoryvia CVE List
- github.com/thelia/thelia/security/advisories/GHSA-gcgv-f8rf-w2wcExploitvia CVE List
- github.com/thelia/thelia/blob/3.2.0/core/lib/Thelia/Core/Serializer/Serializer/CSVSerializer.phpReferencevia CVE List