Description
A vulnerability was detected in Bahleel 0.1.0/0.1.1. Affected is the function fputcsv of the file app/Exporters/CsvExporter.php. The manipulation results in csv injection. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-11-09
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: Potential cross‑site scripting and unintended data manipulation via CSV injection
Action: Apply Mitigation
AI Analysis

Impact

The vulnerability in Bahleel’s CsvExporter.php arises from using the fputcsv function without sanitizing fields that users can control. The attacker can inject characters that the CSV reader interprets as formulas or scripts, enabling cross‑site scripting or unintended content rendering. The weakness is identified as CWE‑1236 and CWE‑74.

Affected Systems

Bahleel’s open‑source project, versions 0.1.0 and 0.1.1, are impacted. The exploit targets the file app/Exporters/CsvExporter.php, affecting any deployment that uses the default CSV export routine. No other versions or components have been reported vulnerable.

Risk and Exploitability

The CVSS score is 5.1, indicating a medium impact. The EPSS score is not available, but the vulnerability can be invoked remotely through a crafted CSV export request, and the project has not provided a patch yet. Because it is not listed in CISA KEV, no active exploits are known, but the lack of mitigation by the vendor suggests the risk could increase until a fix or a robust input‑sanitization measure is implemented.

Generated by OpenCVE AI on November 9, 2026 at 11:35 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Sanitize all CSV fields before passing to fputcsv, such as prefixing leading characters like =, +, - with a single quote or another escape character.
  • Validate and whitelist field contents to ensure only expected characters reach the export routine.
  • Restrict or disable the ability for end users to trigger CSV export from untrusted sources and monitor for anomalous export activity.

Generated by OpenCVE AI on November 9, 2026 at 11:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 09 Nov 2026 10:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in Bahleel 0.1.0/0.1.1. Affected is the function fputcsv of the file app/Exporters/CsvExporter.php. The manipulation results in csv injection. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.
Title Bahleel CsvExporter.php fputcsv csv injection
First Time appeared Bahleel
Bahleel bahleel
Weaknesses CWE-1236
CWE-74
CPEs cpe:2.3:a:bahleel:bahleel:*:*:*:*:*:*:*:*
Vendors & Products Bahleel
Bahleel bahleel
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:C'}

cvssV3_0

{'score': 5.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C'}

cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Bahleel Bahleel
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-11-09T10:30:16.361Z

Reserved: 2026-11-08T20:43:07.074Z

Link: CVE-2026-124591

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-09T11:17:24.743

Modified: 2026-11-09T11:17:24.907

Link: CVE-2026-124591

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-09T11:45:09Z

Weaknesses
  • CWE-1236

    Improper Neutralization of Formula Elements in a CSV File

  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')