A flaw in the registrations export feature of the iCagenda extension allows a malicious user to insert spreadsheet formulas into the CSV output. When exported files are opened in common spreadsheet applications, the embedded formulas can be executed or may cause unintended display of data. This vulnerability can lead to information disclosure or even remote code execution on the end–user’s machine if the spreadsheet application interprets the data as executable code.

Organizations using the Joomla extension from icagenda.com, specifically iCagenda versions 3.5.0 through 4.0.16, are impacted. The vulnerability is present in all releases within this range and has not been fixed in later versions.

The CVSS score of 5.3 indicates a moderate level of severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via the CSV export functionality, which may be accessible to authenticated users with permissions to view or export registration data. Exploitation would require the attacker to trigger the export and then deliver a file to a target user who opens it in a spreadsheet program. No public exploit has been reported, but the lack of a KEV listing does not eliminate the risk of targeted attacks.