CSV Injection Vulnerability in Bahleel by Bahleel Team
CVE-2026-124591

5.1MEDIUM

Key Information:

Vendor

Bahleel Team

Status
Bahleel
Vendor
CVE Published:
9 November 2026

What is CVE-2026-124591?

A CSV injection vulnerability was identified in the Bahleel application, specifically in the fputcsv function located in app/Exporters/CsvExporter.php. This issue allows an attacker to manipulate CSV files generated by the application, leading to the potential execution of arbitrary commands when the file is opened in spreadsheet applications. The vulnerability can be exploited remotely, posing a significant risk to users of the affected versions. Despite being notified early through an issue report, the project maintainers have yet to address the issue.

Affected Version(s)

Bahleel 0.1.0

Bahleel 0.1.1

References

https://vuldb.com/vuln/433015
vdb-entrytechnical-description
https://vuldb.com/vuln/433015/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-124591
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

summmm (VulDB User)
VulDB CNA Team
.