CVE-2026-109396 in Thelia
Summary
by MITRE • 10/12/2026
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +, - or @ that CSVSerializer exports verbatim, executing formulas in the administrator's spreadsheet application.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified as a CSV formula injection flaw within Thelia versions prior to 3.1.2 and 3.2.x before 3.2.1 represents a significant security risk stemming from improper handling of user-supplied data during export operations. This specific weakness allows unauthenticated attackers to inject malicious spreadsheet formulas by manipulating input fields such as registration details, checkout information, or newsletter subscription entries. The core technical flaw lies in the CSVSerializer component, which exports these values verbatim without sanitizing characters that are interpreted as formula initiators by common spreadsheet applications like Microsoft Excel or LibreOffice Calc. Specifically, when an attacker submits data beginning with special characters such as equals signs, plus signs, hyphens, or at symbols, the resulting CSV file preserves these prefixes exactly as entered. When an administrator subsequently opens this exported file in a spreadsheet application, the software interprets the leading character as the start of a formula rather than plain text, thereby triggering execution.
This type of vulnerability is formally categorized under CWE-113, which covers Improper Neutralization of CRLF Sequences in HTTP Headers, although more accurately it aligns with CWE-74 and CWE-95 regarding injection flaws where user input is not properly validated before being used as code or commands within a specific interpreter. In this context, the CSV format acts as an intermediate data exchange mechanism that inadvertently serves as a vector for command execution within the spreadsheet application environment. The attack chain begins with unauthenticated access to public-facing forms on the Thelia platform. By crafting input fields with values starting with =, +, -, or @, the attacker ensures that when this data is included in an export file generated by the system, it retains its formula-like structure. This bypasses traditional security controls because the injection occurs at the application layer during data serialization rather than through direct SQL or code execution on the server itself.
The operational impact of this vulnerability extends beyond simple data corruption and can lead to severe consequences including information disclosure, remote code execution via DDE attacks, and denial of service against administrative workflows. Spreadsheet applications often support Dynamic Data Exchange (DDE) protocols which allow formulas to interact with external programs or files on the host system. An attacker could potentially craft a formula that references an external resource, such as http://evil.com/payload.xls#macro1, causing the administrator's machine to download and execute malicious content upon opening the file. This poses a direct threat to organizational security posture by compromising administrative accounts through social engineering tactics disguised as routine data export tasks. Furthermore, even without DDE exploitation, simple formulas can be used to exfiltrate data from other cells in the spreadsheet or cause application crashes leading to denial of service conditions for critical business operations involving order management and customer data analysis.
Mitigation strategies must focus on immediate patching and defensive coding practices within CSV generation modules. The primary remediation is upgrading Thelia to version 3.1.2 or later, where this serialization flaw has been addressed by implementing proper escaping mechanisms that neutralize formula-starting characters before export. For organizations unable to upgrade immediately, applying a web application firewall rule to detect and block input containing leading special characters in relevant form fields can provide temporary protection. Additionally, administrators should be educated on the risks of opening CSV files from untrusted sources or generated by internal systems without verification. Enabling Protected View in spreadsheet applications when opening such files can also mitigate execution risk by preventing automatic formula evaluation until explicitly enabled by the user. From a broader security architecture perspective, this incident highlights the importance of validating and sanitizing data at all stages of processing, particularly during serialization for external consumption formats like CSV which are prone to interpretation ambiguities across different software implementations.