---
id: "CVE-2026-111038"
kind: "vulnerability"
aliases: ["CVE-2026-111038"]
title: "Coupa Supplier Portal: CSV exports let formulas run in spreadsheets"
severity: "high"
cvss: 7.3
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Coupa Supplier Portal", "fixed": [], "affected": "SaaS, Tenders module CSV export; no version stated", "ecosystem": "vendor"}]
ecosystems: []
tags: ["coupa", "csv-injection", "procurement", "saas", "vendor"]
not_affected_if: ["no-coupa-supplier-portal", "no-csv-export-use", "no-tenders-module"]
published_at: "2026-11-04T10:17:25+00:00"
first_seen_at: "2026-11-04T10:26:34+00:00"
updated_at: "2026-11-04T10:29:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111038", "first_seen_at": "2026-11-04T10:26:34+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T10:29:32+00:00"}]
---

# Coupa Supplier Portal: CSV exports let formulas run in spreadsheets

Coupa Supplier Portal does not sanitise user-supplied values, such as event names or Tenders templates, before writing them into CSV exports. When a victim opens an exported file in a spreadsheet program, injected formulas can run commands or read information under the victim's session.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Coupa Supplier Portal affected SaaS, Tenders module CSV export; no version stated fixed ?

## How to check

Confirm whether your organisation uses Coupa Supplier Portal, especially the Tenders module. Treat CSV exports from it as untrusted: look for cells starting with =, +, -, @ in event names or templates. Open exports in a text editor or with formula execution and DDE disabled.

## Fix

No fix reported as of 2026-11-04 (INCIBE notice). Coupa Supplier Portal is SaaS, so any fix would be applied by Coupa; ask Coupa for status.

## Timeline

- 2026-11-04T10:26:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111038
- 2026-11-04T10:29:32+00:00 analyst — Only INCIBE-CERT coordinator notice (INCIBE-2026-836) found; says no solution reported yet. No Coupa vendor advisory found, so nothing marked verified. Not exploited, no PoC seen.

## Documents

- [advisory] INCIBE-CERT: Multiple vulnerabilities in Coupa's Total Spend Management Platform https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-coupas-total-spend-management-platform

## From the sources

CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform. The vulnerability arises because certain user-controlled data, such as event names or templates within the Tenders module, are not properly validated or sanitised before being included in CSV files generated by the application. An attacker with low privileges can input specially crafted values that begin with characters interpreted as formulas by spreadsheet applications. When a victim downloads and opens the generated file in a compatible client, the content may be interpreted as a formula, potentially leading to unauthorised actions such as the execution of commands via mechanisms such as DDE, access to information, or interaction with system resources under the victim’s context.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_