CSV Formula Injection Vulnerability in Coupa Supplier Portal

CVE-2026-111038

What is CVE-2026-111038?

The Coupa Supplier Portal contains a vulnerability that allows for CSV formula injection through its export functionality. This weakness is due to insufficient validation and sanitization of user-inputted data, such as event names or templates in the Tenders module. An attacker with low privileges can input specially crafted values that begin with formula characters, which may be interpreted by spreadsheet applications when the victim opens the generated CSV file. This could result in unauthorized actions, including command execution through DDE, exposing sensitive information, or manipulating system resources under the victim’s context.

References