CVE-2026-124591 · Package
NO FIX YET
Bahleel 0.1.0 and 0.1.1 write user-supplied values into CSV exports without neutralizing them, in the fputcsv call in app/Exporters/CsvExporter.php. An attacker can plant spreadsheet formulas that run when a victim opens the exported file.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running Bahleel 0.1.0 or 0.1.1 that export user-entered data to CSV and let people open those exports in spreadsheet software. The project has not responded to the early report, so no fixed version is known. Installations that do not use the CSV exporter are not affected.
Not affected if no-csv-export, other-version
Who cares bahleel, csv-export, php
app/Exporters/CsvExporter.php in the Bahleel install and check whether it calls fputcsv on unsanitized data.0.1.0 and 0.1.1.No fix yet, per the sources.
A vulnerability was detected in Bahleel 0.1.0/0.1.1. Affected is the function fputcsv of the file app/Exporters/CsvExporter.php. The manipulation results in csv injection. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.