The vulnerability occurs because the wger member export endpoint does not sanitize user‑supplied first_name and last_name fields, permitting an attacker to embed spreadsheet formulas within the exported TSV. A compromised formula such as =HYPERLINK can transmit confidential admin data to an external address, and other function attacks could execute code or otherwise manipulate the spreadsheet once an administrator opens the file. This flaw is a classic spreadsheet formula injection (CWE‑1236) and could allow an attacker to gain significant information or perform actions when the exported file is opened in Excel, LibreOffice, or similar office tools.

The flaw exists in all wger-project:wger installations running any version prior to 2.6. No specific minor patches are identified; the advertised fix applies to the 2.6 release and beyond, eliminating the unsanitized export logic.

With a CVSS score of 4.8 the vulnerability is classified as moderate severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Attackers would need to be able to trigger a member export, thus a user with member level access, and then obtain or force an administrator to open the resulting file in a spreadsheet application to exploit the injected formulas. Although the attack vector is limited to the export process, the potential impact on confidentiality and integrity is significant if the attacker’s injected formula is executed.