CSV Formula Injection Vulnerability in Thelia by Thelia

CVE-2026-109396

What is CVE-2026-109396?

The Thelia software prior to versions 3.1.2 and 3.2.1 contains a vulnerability allowing unauthenticated users to inject spreadsheet formulas through manipulated registration, checkout, or newsletter fields. Attackers can enter malicious names, addresses, or phone numbers prefixed with symbols like =, +, - or @, enabling them to export these formulas without filtering. This can lead to unintended execution of the formulas in the administrator’s spreadsheet application, posing a significant security risk.

References