The vulnerability allows untrusted user data to be written verbatim into Excel exports for administrators, which can result in formula injection. When an administrator or a user opens the exported file in Excel, the injected formula can be executed, allowing the attacker to run arbitrary code or access sensitive data within the environment of the machine that opens the file. This flaw stems from the failure to validate or sanitize user input before inclusion in the exported spreadsheet (CWE-148).

The flaw affects the Venueless product developed by Pretix. No specific version numbers are supplied in the advisory, so all versions of Venueless that provide an unfiltered Excel export functionality should be considered potentially vulnerable until the vendor releases a fix.

With a CVSS score of 5.1, the vulnerability is rated moderate. No EPSS score was disclosed and it is not listed in the CISA KEV catalog, indicating that the vulnerability may not be widely exploited yet. The attack requires a user who can download the export and open it in Excel, so the exploit can be performed locally by anyone capable of executing the file. The flaw is most likely to affect users who have administrative credentials and use the export feature to create spreadsheets for analysis or reporting.