Improper Neutralization of Formula Elements in a CSV File in wagtail - #VU156669
Published: October 21, 2026
Vulnerability identifier: #VU156669
CSH Severity: Medium
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-1236
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information through injected spreadsheet formulas.
The vulnerability exists due to improper neutralization of formula elements in Wagtail's XLSX export functionality when exporting untrusted user input from forms, reports, or other sources. A remote attacker can supply a crafted string that is exported as a formula and interpreted when a victim opens the file in an external spreadsheet application to potentially disclose sensitive information.
Affected software
wagtail
Remediation
Install security update from vendor's website.
wagtail - addressed in versions 7.0.10, 7.4.4, 8.0.1