{"id":"CVE-2026-111038","kind":"vulnerability","aliases":["CVE-2026-111038"],"related":[],"title":"Coupa Supplier Portal: CSV exports let formulas run in spreadsheets","description":"CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform. The vulnerability arises because certain user-controlled data, such as event names or templates within the Tenders module, are not properly validated or sanitised before being included in CSV files generated by the application. An attacker with low privileges can input specially crafted values that begin with characters interpreted as formulas by spreadsheet applications. When a victim downloads and opens the generated file in a compatible client, the content may be interpreted as a formula, potentially leading to unauthorised actions such as the execution of commands via mechanisms such as DDE, access to information, or interaction with system resources under the victim’s context.","summary":"Coupa Supplier Portal does not sanitise user-supplied values, such as event names or Tenders templates, before writing them into CSV exports. When a victim opens an exported file in a spreadsheet program, injected formulas can run commands or read information under the victim's session.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Coupa Supplier Portal","fixed":[],"affected":"SaaS, Tenders module CSV export; no version stated","ecosystem":"vendor"}],"ecosystems":[],"tags":["coupa","csv-injection","procurement","saas","vendor"],"not_affected_if":["no-coupa-supplier-portal","no-csv-export-use","no-tenders-module"],"how_to_check":"Confirm whether your organisation uses Coupa Supplier Portal, especially the Tenders module. Treat CSV exports from it as untrusted: look for cells starting with =, +, -, @ in event names or templates. Open exports in a text editor or with formula execution and DDE disabled.","fix":"No fix reported as of 2026-11-04 (INCIBE notice). Coupa Supplier Portal is SaaS, so any fix would be applied by Coupa; ask Coupa for status.","status":"open","published_at":"2026-11-04T10:17:25+00:00","first_seen_at":"2026-11-04T10:26:34+00:00","triaged_at":"2026-11-04T10:27:09+00:00","updated_at":"2026-11-04T10:29:32+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-04T10:27:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Coupa Supplier Portal: CSV exports let formulas run in spreadsheets","impact":"medium","summary":"Coupa Supplier Portal does not sanitise user-supplied values, such as event names or Tenders templates, before writing them into CSV exports. When a victim opens an exported file in a spreadsheet program, injected formulas can run commands or read information under the victim's session.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["coupa","saas","procurement"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Formulas run commands or read data on victims' spreadsheet machines","analyst_note":"Check the Coupa security advisory or vendor notice for affected tenants, patch status and whether the fix is already deployed in SaaS.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-coupa-supplier-portal"],"who_is_affected":"The flaw sits in the hosted Coupa Supplier Portal SaaS, so the exposed party is the vendor's tenant and its users who download CSV exports from the Tenders module. A low-privileged account is needed to plant the payload, and a victim must download and open the file in a spreadsheet application. Organisations that do not use Coupa Supplier Portal exports can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000685,"input_tokens":4248,"output_tokens":521,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Coupa security advisory or vendor notice for affected tenants, patch status and whether the fix is already deployed in SaaS.","search":"'-111038':13A,16A '-2026':12A,15A 'access':181C 'action':169C 'applic':123C,143C 'aris':91C 'attack':125C 'begin':135C 'certain':93C 'charact':137C 'client':156C 'command':65B,175C 'compat':155C 'content':158C 'context':193C 'control':96C 'coupa':1A,17A,20B,27B,84C 'craft':132C 'csv':4A,22B,48B,74C,118C 'csv-inject':21B 'cve':11A,14A 'data':97C 'dde':180C 'download':147C 'event':39B,100C 'execut':173C 'export':5A,49B,55B,80C 'file':56B,119C,152C 'formula':7A,62B,75C,140C,164C 'function':81C 'generat':120C,151C 'includ':116C 'inform':68B,183C 'inject':23B,61B,76C 'input':130C 'interact':185C 'interpret':138C,161C 'lead':166C 'let':6A 'low':127C 'may':159C 'mechan':177C 'modul':107C 'name':40B,101C 'open':53B,149C 'platform':88C 'portal':3A,19A,29B,86C 'potenti':165C 'privileg':128C 'procur':24B 'program':60B 'proper':110C 'read':67B 'resourc':188C 'run':8A,64B 'saa':25B,87C 'sanitis':32B,113C 'session':73B 'special':131C 'spreadsheet':10A,59B,142C 'suppli':35B 'supplier':2A,18A,28B,85C 'system':187C 'templat':43B,103C 'tender':42B,106C 'unauthoris':168C 'user':34B,95C 'user-control':94C 'user-suppli':33B 'valid':111C 'valu':36B,133C 'vendor':26B 'via':176C 'victim':52B,71B,146C,191C 'vulner':77C,90C 'within':104C 'write':45B","nicknames":[],"mitigations":[],"who_affected":"The flaw sits in the hosted Coupa Supplier Portal SaaS, so the exposed party is the vendor's tenant and its users who download CSV exports from the Tenders module. A low-privileged account is needed to plant the payload, and a victim must download and open the file in a spreadsheet application. Organisations that do not use Coupa Supplier Portal exports can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["coupasupplierportal","supplierportal"],"ptokens":["coupa","portal","supplier"],"labels":["coupa","csvinjection","high","procurement","saas","vendor"],"campaign_type":null,"first_public_at":"2026-11-04T10:17:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-coordination@incibe.es","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111038","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111038","severity":null,"published_at":"2026-11-04T10:17:25+00:00","modified_at":"2026-11-04T10:17:25+00:00","first_seen_at":"2026-11-04T10:26:34+00:00","fetched_at":"2026-11-04T10:26:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111038:1659","url":null,"severity":null,"published_at":"2026-11-04T10:29:32+00:00","modified_at":"2026-11-04T10:29:32+00:00","first_seen_at":"2026-11-04T10:29:32+00:00","fetched_at":"2026-11-04T10:29:32+00:00","note":"Only INCIBE-CERT coordinator notice (INCIBE-2026-836) found; says no solution reported yet. No Coupa vendor advisory found, so nothing marked verified. Not exploited, no PoC seen."}],"documents":[{"id":66162,"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-coupas-total-spend-management-platform","title":"INCIBE-CERT: Multiple vulnerabilities in Coupa's Total Spend Management Platform","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}