CSV Injection Vulnerability in Eladmin by Elunez
CVE-2025-22978

9.8CRITICAL

Key Information:

Vendor

Elunez

Status
Eladmin
Vendor
CVE Published:
3 February 2025

What is CVE-2025-22978?

Eladmin versions up to 2.7 are susceptible to a CSV Injection vulnerability in the exception log download module. By exploiting this flaw, attackers may craft malicious CSV files that can execute arbitrary commands when opened. This can lead to unauthorized access or manipulation of sensitive data, showcasing significant risks to data integrity and user security. Users and administrators of Eladmin should implement necessary security measures and consider upgrading to unaffected versions to mitigate potential threats.

References

https://github.com/elunez/eladmin/issues/863
https://github.com/elunez/eladmin/commit/d6a16e9afc0a3b96...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.