What’s Vulnerable › Vulnerabilities

CVE-2017-18049

• Severity: medium (CVSS 5.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-01-23 · updated 2026-06-17
• Weakness: CWE-74

Description

In the CSV export feature of SilverStripe before 3.5.6, 3.6.x before 3.6.3, and 4.x before 4.0.1, it's possible for the output to contain macros and scripts, which may be executed if imported without sanitization into common software (including Microsoft Excel). For example, the CSV data may contain untrusted user input from the "First Name" field of a user's /myprofile page.

Affected products

• Silverstripe: through 3.5.5; from 3.6.0 through 3.6.2; 4.0.0

References

• https://www.exploit-db.com/exploits/43396/
• https://www.silverstripe.org/download/security-releases/ss-2017-007
• https://www.exploit-db.com/exploits/43396/
• https://www.silverstripe.org/download/security-releases/ss-2017-007

Get alerted when CVE-2017-18049 or the next vulnerability affects your stack