CSV Formula Injection Vulnerability in MRBS by Meeting Room Booking System

CVE-2026-129133

What is CVE-2026-129133?

The MRBS application prior to version 1.13.0 is susceptible to a CSV formula injection vulnerability that allows authenticated users to inject malicious spreadsheet formulas. This occurs due to the ineffective escaping of leading formula characters in the escape() function within the web/report.php file. Attackers can exploit this vulnerability by storing these formulas in booking names, descriptions, or custom fields. When privileged users access exported CSV reports, these injected formulas can execute, potentially leading to data exfiltration or even arbitrary command execution through DDE. It is crucial for users to upgrade to the latest version to mitigate this risk.

References