CVE-2026-65875: BaserCMS CSV Injection Vulnerability

CVE-2026-65875 Overview

CVE-2026-65875 is a CSV file injection vulnerability affecting BaserCMS, an open-source content management system maintained by the baserCMS Users Community. Attackers can inject formula payloads into fields that BaserCMS later exports as CSV. When a user downloads and opens the exported file in a spreadsheet application, the embedded formula executes with the privileges of that user.

The flaw is categorized under [CWE-1236: Improper Neutralization of Formula Elements in a CSV File]. Exploitation requires user interaction, specifically opening the malicious CSV in a client that evaluates formulas.

Critical Impact
A remote attacker without authentication can inject spreadsheet formulas into BaserCMS data that, once exported and opened, execute code on the downloader's workstation.

Affected Products

BaserCMS (distributions maintained by the baserCMS Users Community)
Refer to the basercms.net Security Advisory for specific affected versions
Refer to the JVN Security Vulnerability Report for coordinated disclosure details

Discovery Timeline

2026-08-03 - CVE-2026-65875 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-65875

Vulnerability Analysis

CSV injection, sometimes called formula injection, occurs when an application writes untrusted input into a CSV file without neutralizing spreadsheet control characters. Characters such as =, +, -, and @ at the start of a cell instruct Excel, LibreOffice Calc, and Google Sheets to evaluate the cell as a formula.

BaserCMS accepts user-supplied content through its administrative and content submission surfaces. When an operator later exports that data to CSV, the malicious cell content is preserved verbatim. Opening the file triggers formula evaluation in the victim's spreadsheet application.

Formulas can invoke functions such as HYPERLINK, WEBSERVICE, or DDE to exfiltrate data, contact attacker-controlled endpoints, or launch external processes depending on the client configuration. The impact scope extends beyond BaserCMS to the downstream workstation and its data.

Root Cause

The root cause is missing output neutralization when BaserCMS serializes stored fields into CSV. The application does not prefix untrusted cell values with a safe character such as a single quote, and it does not strip or escape leading formula triggers.

Attack Vector

An attacker submits input containing a formula prefix through any BaserCMS field that is later exported. A privileged BaserCMS user, such as an administrator generating a report, downloads the CSV. When the user opens the file in a spreadsheet application, the formula executes in that user's context.

The vulnerability requires no authentication on the injection side but depends on user interaction to trigger execution. No verified public exploit code is currently available.

Detection Methods for CVE-2026-65875

Indicators of Compromise

CSV files exported from BaserCMS containing cells that begin with =, +, -, @, tab, or carriage return characters followed by function names
Outbound network requests from spreadsheet application processes such as excel.exe or soffice.bin shortly after a CSV is opened
Child processes spawned by spreadsheet applications, particularly cmd.exe, powershell.exe, or mshta.exe

Detection Strategies

Scan CSV exports for cells beginning with formula trigger characters before distribution
Alert on spreadsheet applications initiating outbound HTTP/S connections or launching command interpreters
Review BaserCMS submission logs for entries containing formula prefixes in text fields

Monitoring Recommendations

Log all CSV export operations from BaserCMS administrative interfaces with the requesting user and record set
Correlate download events with subsequent process execution telemetry on administrator workstations
Track user-agent activity accessing BaserCMS submission endpoints from unauthenticated sources

How to Mitigate CVE-2026-65875

Immediate Actions Required

Apply the fixed BaserCMS release referenced in the basercms.net Security Advisory
Audit existing exported CSV files for cells beginning with formula trigger characters and quarantine suspect exports
Instruct administrators to open BaserCMS CSV exports in a text editor before loading them into a spreadsheet application

Patch Information

BaserCMS maintainers have published a security advisory tracked as JVN_94952030. Refer to the basercms.net Security Advisory and the JVN Security Vulnerability Report for fixed version identifiers and upgrade instructions.

Workarounds

Configure spreadsheet applications to disable Dynamic Data Exchange (DDE) and external content loading by default
Sanitize CSV exports downstream by prefixing any cell beginning with =, +, -, or @ with a single quote before distribution
Restrict CSV export functionality to trusted administrators until the patched release is deployed