CVE-2026-86257: wger before 2.6 CSV Formula Injection via member export

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-06 · updated 2026-09-08
Weakness: CWE-1236

Description

wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or LibreOffice Calc.

Affected products

wger-project wger: before 2.6 — fixed in 2.6

How to fix

Upgrade to a fixed version: wger-project wger 2.6. Check the vendor advisory for mitigations.

References

https://github.com/wger-project/wger/security/advisories/GHSA-xq9m-hmp9-fw87
https://www.vulncheck.com/advisories/wger-before-2.6-csv-formula-injection-via-member-export
https://github.com/wger-project/wger/security/advisories/GHSA-xq9m-hmp9-fw87

Get alerted when CVE-2026-86257 or the next vulnerability affects your stack