CVE-2026-109396 Details

A CSV formula injection vulnerability has been identified in Thelia versions prior to 3.1.2 and in the 3.2.x series prior to 3.2.1. This vulnerability allows unauthenticated users to inject spreadsheet formulas into CSV exports by manipulating registration, checkout, or newsletter fields. The injected formulas are executed when the exported CSV file is opened in a spreadsheet application by an administrator. The issue arises because the CSV export process does not properly sanitize values that could be interpreted as formulas, such as those starting with '=', '+', '-', or '@'.

Users can update to Thelia versions 3.1.2 or 3.2.1, both of which include the necessary fix. After updating, it's recommended to warm up the cache and, if using Apache, ensure the document cache is served with the correct headers to prevent execution of any remaining vulnerable files.