CSV Injection Vulnerability in Poweradmin DNS Management Tool by PowerDNS
CVE-2026-47693
6.9MEDIUM
What is CVE-2026-47693?
Poweradmin, a web-based DNS administration tool for PowerDNS servers, is susceptible to CSV Injection through its log export feature. Specifically, this issue arises when user-related data, particularly from the username field, is exported to CSV files without adequate sanitization of formula-triggering characters such as '=', '+', '-', and '@'. As a result, when the exported CSV file is opened in common spreadsheet applications, any formula embedded in the username can be executed, potentially enabling phishing attacks against administrators or leading to unauthorized data exfiltration. The vulnerability is addressed in Poweradmin versions 4.2.4 and 4.3.3.
Affected Version(s)
poweradmin < 4.2.4 < 4.2.4
poweradmin >= 4.3.0, < 4.3.3 < 4.3.0, 4.3.3