The vulnerability allows unauthenticated visitors to inject spreadsheet formulas through specially crafted registration, checkout, or newsletter fields. When an administrator later opens the exported CSV file, the formulas are executed by the spreadsheet application, potentially leading to code execution or data exposure on the administrator’s machine. The weakness is an injection flaw in CSV serialization (CWE-1236) that grants attackers a non‑destructive but exploitable vector for local execution if the administrator processes the file.

Thelia e‑commerce platform versions prior to 3.1.2 and all 3.2.x releases earlier than 3.2.1 are affected. The issue resides in the CSVSerializer component used for exporting data such as registrations, checkouts, or newsletters.

The CVSS score is 2.3, reflecting low overall severity, and no EPSS score is available, indicating that no data suggest frequent exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can achieve the exploit by submitting crafted input that includes a formula prefix (e.g., '=', '+', '-', '@') through public forms. The CSV file is then exported verbatim, allowing an administrator to trigger the formula when opening the file in a spreadsheet program.