Coupa’s Total Spend Management Platform exports CSV files from the Supplier Portal that include data supplied by users in the Tenders module without proper sanitisation. The application accepts values such as event names or templates that, if crafted to begin with characters recognised as spreadsheet formulas (for example "=", "+", etc.), are written directly into the CSV file. When a user downloads and opens the file in a common spreadsheet client the application may interpret those characters as a formula. The spreadsheet can then trigger mechanisms such as DDE, allowing the execution of commands, accessing local information, or interacting with system resources within the victim’s security context. This flaw can be used by an attacker with low privileges to induce the victim’s client to perform actions they did not intend, potentially leading to the compromise of the victim’s machine or the extraction of sensitive data. The vulnerability is categorised as CWE‑1236, which denotes an input not sanitized prior to use in a context that can process scripts or commands.

Coupa’s Total Spend Management Platform, specifically the Supplier Portal SaaS component that handles CSV exports from the Tenders module. No specific version information is supplied, so all releases that include the unvalidated export code are potentially affected until a fix is released by the vendor.

The CVSS score of 7.3 indicates a high severity, though the EPSS score is not available and the issue is not listed in the CISA KEV catalog. The likely attack vector is client‑side: an attacker first enters a crafted value into a low‑privilege user account, which is then included in an exported CSV. When a victim subsequently opens that CSV with a spreadsheet application that automatically evaluates formulae, the malicious code can execute under the victim’s user account. Because the flaw relies on user interaction with a standard office application, its exploitation requires that the victim opens the file, which may limit the attack surface but still poses a significant insider or social engineering risk.