CVE-2026-47693

Katalog CVE

CVSS 6.9 · Medium EPSS 0,38%

Kerentanan Improper Neutralization of Formula Elements in a CSV File. Skor CVSS 3.1 6.9 (Medium) menurut github.com.

Deskripsi (NVD)

Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 are vulnerable to CSV Injection (Formula Injection) in its log export functionality. User-controlled data — specifically the username field — is written to exported CSV files without sanitizing formula trigger characters (=, +, -, @). When an administrator exports activity logs and opens the resulting CSV in a spreadsheet application (Microsoft Excel, LibreOffice Calc, Google Sheets), any formula stored in a username is executed by the application. This can be used for phishing attacks against administrators or data exfiltration. Versions 4.2.4 and 4.3.3 patch the issue.

Rincian

Terbit di NVD

23 Juni 2026

Terakhir diubah

25 Juni 2026

Status NVD

Deferred

CVSS 3.1

6.9 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1236: Improper Neutralization of Formula Elements in a CSV File

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 29,6% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/poweradmin/poweradmin/releases/tag/v4.2.4
• https://github.com/poweradmin/poweradmin/releases/tag/v4.3.3
• https://github.com/poweradmin/poweradmin/security/advisories/GHSA-3h6h-67x3-cv5x