{"id":"CVE-2026-124591","kind":"vulnerability","aliases":["CVE-2026-124591"],"related":[],"title":"Bahleel: CSV export lets remote input inject spreadsheet formulas","description":"A vulnerability was detected in Bahleel 0.1.0/0.1.1. Affected is the function fputcsv of the file app/Exporters/CsvExporter.php. The manipulation results in csv injection. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.","summary":"Bahleel 0.1.0 and 0.1.1 write user-supplied values into CSV exports without neutralizing them, in the fputcsv call in app/Exporters/CsvExporter.php. An attacker can plant spreadsheet formulas that run when a victim opens the exported file.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bahleel","csv-export","package","php"],"not_affected_if":["no-csv-export","other-version"],"how_to_check":"- Look for `app/Exporters/CsvExporter.php` in the Bahleel install and check whether it calls `fputcsv` on unsanitized data.\n- Check the installed Bahleel version against `0.1.0` and `0.1.1`.","fix":null,"status":"open","published_at":"2026-11-09T11:17:24+00:00","first_seen_at":"2026-11-09T11:26:04+00:00","triaged_at":"2026-11-09T11:26:38+00:00","updated_at":"2026-11-09T11:26:38+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T11:26:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Bahleel: CSV export lets remote input inject spreadsheet formulas","impact":"medium","summary":"Bahleel 0.1.0 and 0.1.1 write user-supplied values into CSV exports without neutralizing them, in the fputcsv call in app/Exporters/CsvExporter.php. An attacker can plant spreadsheet formulas that run when a victim opens the exported file.","audience":"developers","category":"package","nicknames":[],"who_cares":["bahleel","php","csv-export"],"confidence":0.6,"fix_status":"none","needs_auth":"unknown","worst_case":"spreadsheet formulas run on a viewer's computer","analyst_note":"Confirm whether any fixed version or mitigation exists; the project has not responded to the issue report.","how_to_check":"- Look for `app/Exporters/CsvExporter.php` in the Bahleel install and check whether it calls `fputcsv` on unsanitized data.\n- Check the installed Bahleel version against `0.1.0` and `0.1.1`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-csv-export","other-version"],"who_is_affected":"Teams running Bahleel 0.1.0 or 0.1.1 that export user-entered data to CSV and let people open those exports in spreadsheet software. The project has not responded to the early report, so no fixed version is known. Installations that do not use the CSV exporter are not affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00073,"input_tokens":4547,"output_tokens":551,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124591':12A,15A '-2026':11A,14A '/0.1.1':65C '0.1.0':23B,64C '0.1.1':25B 'affect':66C 'app/exporters/csvexporter.php':42B,74C 'attack':44B,82C 'bahleel':1A,16B,22B,63C 'call':40B 'csv':2A,18B,32B,79C 'csv-export':17B 'cve':10A,13A 'detect':61C 'earli':94C 'export':3A,19B,33B,56B 'file':57B,73C 'formula':9A,48B 'fputcsv':39B,70C 'function':69C 'inform':90C 'inject':7A,80C 'input':6A 'issu':97C 'launch':85C 'let':4A 'manipul':76C 'may':83C 'neutral':35B 'open':54B 'packag':20B 'php':21B 'plant':46B 'problem':93C 'project':88C 'remot':5A,86C 'report':98C 'respond':102C 'result':77C 'run':50B 'spreadsheet':8A,47B 'suppli':29B 'user':28B 'user-suppli':27B 'valu':30B 'victim':53B 'vulner':59C 'without':34B 'write':26B 'yet':103C","nicknames":[],"mitigations":[],"who_affected":"Teams running Bahleel 0.1.0 or 0.1.1 that export user-entered data to CSV and let people open those exports in spreadsheet software. The project has not responded to the early report, so no fixed version is known. Installations that do not use the CSV exporter are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bahleel","csvexport","medium","package","php"],"campaign_type":null,"search_a":"'-124591':12A,15A '-2026':11A,14A 'bahleel':1A 'csv':2A 'cve':10A,13A 'export':3A 'formula':9A 'inject':7A 'input':6A 'let':4A 'remot':5A 'spreadsheet':8A","search_b":"'0.1.0':23B '0.1.1':25B 'app/exporters/csvexporter.php':42B 'attack':44B 'bahleel':16B,22B 'call':40B 'csv':18B,32B 'csv-export':17B 'export':19B,33B,56B 'file':57B 'formula':48B 'fputcsv':39B 'neutral':35B 'open':54B 'packag':20B 'php':21B 'plant':46B 'run':50B 'spreadsheet':47B 'suppli':29B 'user':28B 'user-suppli':27B 'valu':30B 'victim':53B 'without':34B 'write':26B","search_c":"'/0.1.1':65C '0.1.0':64C 'affect':66C 'app/exporters/csvexporter.php':74C 'attack':82C 'bahleel':63C 'csv':79C 'detect':61C 'earli':94C 'file':73C 'fputcsv':70C 'function':69C 'inform':90C 'inject':80C 'issu':97C 'launch':85C 'manipul':76C 'may':83C 'problem':93C 'project':88C 'remot':86C 'report':98C 'respond':102C 'result':77C 'vulner':59C 'yet':103C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T11:17:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124591","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124591","severity":null,"published_at":"2026-11-09T11:17:24+00:00","modified_at":"2026-11-09T11:17:24+00:00","first_seen_at":"2026-11-09T11:26:04+00:00","fetched_at":"2026-11-09T11:26:04+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}