CVE-2026-47693 Overview
CVE-2026-47693 is a CSV Injection (Formula Injection) vulnerability in Poweradmin, a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 write user-controlled username data to exported CSV log files without sanitizing formula trigger characters (=, +, -, @). When an administrator opens the exported CSV in Microsoft Excel, LibreOffice Calc, or Google Sheets, embedded formulas execute in the spreadsheet context. Attackers can leverage this for phishing campaigns targeting administrators or for data exfiltration. The maintainers patched the issue in versions 4.2.4 and 4.3.3.
Critical Impact
Authenticated attackers can inject spreadsheet formulas through the username field that execute when administrators open exported activity logs, enabling phishing and data exfiltration.
Affected Products
- Poweradmin versions prior to 4.2.4 (4.2.x branch)
- Poweradmin versions prior to 4.3.3 (4.3.x branch)
- Poweradmin log export (CSV) functionality
Discovery Timeline
- 2026-06-23 - CVE-2026-47693 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-47693
Vulnerability Analysis
The flaw is categorized under [CWE-1236] Improper Neutralization of Formula Elements in a CSV File. Poweradmin's log export feature serializes activity log entries — including the username field — directly into CSV rows. The application performs no neutralization of leading formula characters before writing the value to the file.
When the resulting CSV is opened in a spreadsheet program, any cell beginning with =, +, -, or @ is interpreted as a formula. The spreadsheet then evaluates functions such as HYPERLINK, WEBSERVICE, IMPORTXML, or DDE, depending on the application. These functions can fetch attacker-controlled URLs, exfiltrate adjacent cell contents, or render clickable phishing links inside a trusted document.
Exploitation requires the attacker to control or create a Poweradmin account whose username contains a payload, and to wait for an administrator to export and open the activity log.
Root Cause
The root cause is missing output encoding when serializing log records to CSV. Poweradmin treats the username as opaque text and does not prefix risky values with a neutralizing character (such as a single quote or tab) or wrap them in a way that prevents formula parsing in downstream spreadsheet software.
Attack Vector
The attack vector is network-based but requires high privileges to create or modify a user record and user interaction from an administrator opening the exported file. The payload travels through the application's own trusted export path, meaning standard CSV files from the administration interface become the delivery mechanism. See the GitHub Security Advisory GHSA-3h6h-67x3-cv5x for the maintainer's technical description.
No public proof-of-concept exploit code is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-47693
Indicators of Compromise
- Poweradmin user accounts whose username field begins with =, +, -, or @.
- Exported CSV log files containing cells that start with formula trigger characters or reference functions such as HYPERLINK, WEBSERVICE, IMPORTXML, or DDE.
- Outbound network requests from administrator workstations to unexpected hosts shortly after opening a Poweradmin log export.
Detection Strategies
- Query the Poweradmin user table for accounts whose usernames begin with formula trigger characters.
- Scan archived CSV exports for cells matching the regular expression ^[=+\-@].
- Correlate spreadsheet application process launches on administrator hosts with subsequent unexpected DNS or HTTP traffic.
Monitoring Recommendations
- Log and alert on Poweradmin user creation and modification events, especially via the API or self-service registration paths.
- Monitor administrator endpoints for spreadsheet processes (excel.exe, soffice.bin) spawning child processes or initiating outbound network connections.
- Track the use of the activity log export endpoint and review which accounts appear in the resulting files.
How to Mitigate CVE-2026-47693
Immediate Actions Required
- Upgrade Poweradmin to version 4.2.4 (4.2.x branch) or 4.3.3 (4.3.x branch) as documented in the Poweradmin v4.2.4 release and Poweradmin v4.3.3 release.
- Audit existing usernames and rename or disable accounts whose names begin with =, +, -, or @.
- Treat any historical CSV export from an unpatched version as untrusted; do not open it in a spreadsheet application without first inspecting the raw text.
Patch Information
The Poweradmin maintainers fixed the issue in versions 4.2.4 and 4.3.3. Operators running the 4.2.x branch should upgrade to 4.2.4, and operators on the 4.3.x branch should upgrade to 4.3.3. Details are published in GitHub Security Advisory GHSA-3h6h-67x3-cv5x.
Workarounds
- Restrict who can create or modify Poweradmin user accounts until patching is complete.
- Open exported CSV files in a plain-text editor first, or import them using the spreadsheet's text import wizard with all columns set to text format.
- Disable automatic formula execution and Dynamic Data Exchange (DDE) in administrator spreadsheet applications.
- Apply input validation at a reverse proxy or web application firewall to reject usernames beginning with formula trigger characters.
# Example: identify Poweradmin usernames that would trigger formula evaluation
# Run against the Poweradmin database (adjust schema/table as deployed)
mysql -u poweradmin -p poweradmin -e \
"SELECT id, username FROM users WHERE username REGEXP '^[=+\\-@]';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
