CVE-2026-108579 in OpenPanel
Summary
by MITRE • 10/10/2026
OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed spreadsheet formulas by supplying crafted profile IDs to the /track endpoint. Attackers can send tracking events with profile IDs like =HYPERLINK(...) matching a cohort, so exported cohort CSVs execute formulas that exfiltrate adjacent cell data.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/10/2026
OpenPanel versions through 2.3.0 are susceptible to a CSV formula injection vulnerability within the /track endpoint, which permits unauthenticated attackers to inject malicious spreadsheet formulas into generated reports. This flaw arises because the application fails to properly sanitize or escape user-supplied input when it is processed for inclusion in cohort data structures that are subsequently exported as Comma Separated Values files. By crafting specific profile IDs containing formula syntax such as =HYPERLINK(...), an attacker can manipulate the resulting CSV output so that when opened in spreadsheet applications like Microsoft Excel, LibreOffice Calc, or Google Sheets, these formulas execute automatically upon file opening.
The operational impact of this vulnerability is significant because it enables data exfiltration without requiring any form of authentication. Attackers can target specific cohorts by ensuring their injected profile IDs match the criteria for that cohort. When an administrator or authorized user exports the cohort data as a CSV file and opens it in a spreadsheet application, the embedded formula triggers immediately. The HYPERLINK function is particularly dangerous in this context because it allows the attacker to specify a URL where sensitive data from adjacent cells can be sent via HTTP requests. This mechanism effectively turns the exported report into an attack vector that compromises the confidentiality of the data contained within the same row or nearby rows, potentially exposing user identifiers, behavioral metrics, or other proprietary information stored in the OpenPanel system.
From a classification perspective, this vulnerability aligns with CWE-74, which describes injection flaws where untrusted input is converted to commands or queries without proper neutralization of special elements. In the specific context of spreadsheet applications, it also relates to CWE-913, Improper Control of Dynamically-Managed Code Resources, as the application inadvertently allows dynamic code execution within a document format that supports scripting and formula evaluation. Furthermore, this attack vector maps to MITRE ATT&CK technique T1560.002, Archive Collected Data via Compressed or Encrypted Archives, although in this case, the exfiltration is achieved through data harvesting rather than compression. The lack of authentication required for exploitation places it within the broader category of unauthenticated access vulnerabilities that compromise system integrity and confidentiality.
To mitigate this risk, immediate action should be taken to upgrade OpenPanel to a version later than 2.3.0 where this issue has been addressed by implementing strict input validation and output encoding mechanisms. Developers must ensure that any user-supplied data intended for CSV export is sanitized to prevent the interpretation of leading characters such as equals signs or plus signs, which trigger formula evaluation in spreadsheet software. Additionally, applying context-aware escaping techniques can neutralize special characters before they are written to the file system. Organizations should also implement monitoring on their /track endpoints to detect anomalous patterns indicative of injection attempts and restrict access to sensitive cohort data through robust authentication controls as a defense-in-depth measure until patches are applied.