CVE-2026-45263
Summary
Live PoC verified 2026-04-30 against a stock FacturaScripts master at 127.0.0.1:8081. A low-privilege user (lowpriv) created a customer with nombre = "=SUM(1+1)*cmd|/c calc!A1". An admin then exported ListCliente to CSV via ?action=export&option=CSV. The downloaded file contains the raw payload as the first cell of the nombre column, with no leading single quote and no escape. Excel and LibreOffice will execute the formula on open, including DDE invocations such as =cmd|'/c calc'!A1 that spawn arbitrary processes on the admin workstation.
Core/Lib/Export/CSVExport.php::writeData() wraps every cell in the configured delimiter (") and concatenates without inspecting the first character of the value. Spreadsheet applications interpret a cell that starts with =, +, -, @, \t, or \r as a formula. Because FacturaScripts only sanitises HTML metacharacters (< > " ') on save via Tools::noHtml() (Core/Tools.php:45), the formula prefix characters survive untouched all the way to the export. The downstream consumer is the admin who triggered the export, giving the attacker a reliable handoff: low-priv user plants a payload in any text field that ships in the default list export, admin downloads the CSV (all normal billing/sales/purchasing workflow), and the admin's spreadsheet client runs the formula in the admin's local context.
Details
the export does not neutralise leading meta-characters
Core/Lib/Export/CSVExport.php:253-267:
public function writeData(array $data, array $fields = [])
{
if (!empty($fields)) {
$this->writeHeader($fields);
}
foreach ($data as $row) {
$line = [];
foreach ($row as $cell) {
$line[] = is_string($cell) ? $this->getDelimiter() . $cell . $this->getDelimiter() : $cell;
}
$this->csv[] = implode($this->separator, $line);
}
}
A string cell is rendered as "<value>". There is no str_starts_with(...) check for the formula trigger characters (= + - @ \t \r per OWASP CSV-injection guidance) and no leading single-quote guard that Excel and Libr
⚡ Watch CVE-2026-45263
Get an email if CVE-2026-45263 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Advisory coverage (1)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-45263)