CVE-2026-86257 in wger
Summary
by MITRE • 09/06/2026
wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or LibreOffice Calc.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/06/2026
The vulnerability identified in wger versions prior to 2.6 represents a significant security flaw within the gym member TSV export functionality, specifically stemming from insufficient input sanitization of the first_name and last_name fields. This issue classifies as CWE-798, which involves the use of hard-coded credentials or data that allows for unauthorized access, but in this context, it manifests more directly through injection techniques similar to those found in CWE-116 Improper Encoding or Escaping of Output. The core technical failure lies in the application's handling of user-supplied data during the generation of tab-separated value files. When a gym member provides their name for export, the system fails to escape special characters that are interpreted as formula delimiters by spreadsheet applications such as Microsoft Excel or LibreOffice Calc. This lack of proper encoding allows an attacker to craft malicious input strings that bypass standard validation checks and embed executable logic directly into the data payload.
The operational impact of this vulnerability is severe due to its potential for server-side request forgery-like behavior through client-side execution, often categorized under CWE-94 Improper Control of Generation of Code or XSS if interpreted broadly in web contexts, but more accurately aligned with ATT&CK technique T1059 Command and Scripting Interpreter via document macros or formulas. An attacker can inject a formula such as =HYPERLINK to create a link that triggers when the file is opened by an administrator. This mechanism enables data exfiltration where sensitive administrative information stored in other parts of the application, potentially accessible only through authenticated sessions, can be fetched and sent to an external server controlled by the attacker. The success of this attack relies on social engineering or privilege escalation within the gym management structure, as it requires a privileged user, such as an admin, to open the maliciously crafted TSV file in a spreadsheet application that supports formula execution.
Furthermore, the risk extends beyond simple data theft if the injected formulas are designed to execute arbitrary code through vulnerabilities present in older versions of Excel or LibreOffice Calc. This transforms the vulnerability from a mere information disclosure issue into a potential remote code execution vector, aligning with ATT&CK technique T1059 which covers various methods for executing commands on target systems. The persistence and ease of exploitation make this a high-severity concern, particularly in environments where data privacy is paramount and administrative oversight involves reviewing exported member lists regularly.
To mitigate this vulnerability, it is imperative to upgrade wger to version 2.6 or later, which addresses the sanitization logic for these specific fields. In addition to upgrading, administrators should implement strict input validation that rejects any characters capable of initiating formula execution in spreadsheet formats, such as equals signs at the beginning of cell values. Applying output encoding specifically tailored for TSV and CSV exports is also recommended to ensure that special characters are treated as literal data rather than executable commands. Security awareness training for administrative staff regarding the risks of opening untrusted files from external sources can further reduce the likelihood of successful exploitation by preventing the initial trigger event in spreadsheet applications.