CVE-2026-109396

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +,...

CVE-2026-109396

The Thelia platform (versions before 3.1.2 and 3.2.x before 3.2.1 ) is vulnerable to a CSV formula injection vulnerability. The issue resides in the CSVSerializer component, which exports fields like registration, checkout, or newsletter data verbatim. Unauthenticated visitors can exploit this by...

CVE-2026-109396 Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +,...

CVE-2026-109396: Improper Neutralization of Formula Elements in a CSV File

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +,...