CVE-2026-86257 wger-project CVE debrief

Who should care

Defenders responsible for wger installations, especially those with exposed TSV export features, should assess their exposure and prioritize remediation. This includes verifying the wger version, restricting access to the TSV export feature, and implementing input validation and sanitization for first_name and last_name fields.

Why it matters

CVE-2026-86257 is a medium-severity vulnerability in wger that allows gym members to inject spreadsheet formulas into the TSV export endpoint. Defenders should prioritize verifying exposure and remediating vulnerable installations, especially in environments where gym members have access to the TSV export feature. The vulnerability requires verification of wger version and exposure, and remediation involves restricting access to the TSV export feature, implementing input validation and sanitization, and monitoring for suspicious activity.

• Potential admin data exfiltration through injected formulas
• Possible code execution when admins open exported TSV files
• Verification of wger version and exposure to the vulnerable feature
• Remediation priority for vulnerable wger installations

Technical summary

The vulnerability exists in the wger gym management software, specifically in the TSV export endpoint for gym members. The first_name and last_name fields are not properly sanitized, allowing attackers to inject spreadsheet formulas. When an admin opens the exported TSV file in spreadsheet software like Excel or LibreOffice Calc, the injected formulas can be executed, potentially leading to admin data exfiltration or code execution.

Defensive priority

Defenders should prioritize verifying exposure and remediating vulnerable wger installations, especially in environments where gym members have access to the TSV export feature.

Recommended defensive actions

• Verify wger version and exposure to the vulnerable TSV export endpoint
• Restrict access to the TSV export feature to authorized personnel
• Implement input validation and sanitization for first_name and last_name fields
• Monitor for suspicious activity related to exported TSV files
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is confirmed in wger versions before 2.6, where the first_name and last_name fields in the gym member TSV export endpoint are not properly sanitized, allowing for formula injection. The injected formulas can be executed when an admin opens the exported TSV file in spreadsheet software like Excel or LibreOffice Calc, potentially leading to admin data exfiltration or code execution. Defenders should verify the wger version and exposure to the vulnerable feature, and remediate vulnerable installations to prevent potential attacks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.