https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T05:40:01.589336+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2023-41499 cnvd-2023-41499 2026-10-08T05:40:01.593435+00:00 cnvd-2023-41499 https://cve.radiocsirt.org/vuln/euvd-2026-212135 EUVD-2026-212135 2026-10-08T05:40:01.593472+00:00 EUVD-2026-212135 https://cve.radiocsirt.org/vuln/fkie_cve-2023-2629 fkie_cve-2023-2629 2026-10-08T05:40:01.593486+00:00

Improper Neutralization of Formula Elements in a CSV File in GitHub repository pimcore/customer-data-framework prior to 3.3.9.

 https://cve.radiocsirt.org/vuln/ghsa-mq3x-qgwx-3rfw GHSA-mq3x-qgwx-3rfw — Embedding untrusted input inside CSV files leads to Formula Injection/CSV Injection 2026-10-08T05:40:01.593514+00:00

Affected: Packagist: pimcore/customer-management-framework-bundle

### Impact The pimcore application is vulnerable to Formula Injection/CSV Injection via the Firstname, Lastname, Street, Zip & City input fields. These vulnerabilities allow unauthenticated attackers to execute arbitrary code via a crafted excel file.

Successful exploitation can lead to impacts such as client-sided command injection, code execution, or remote ex-filtration of contained confidential data.

### Patches Update to version 3.3.9 or apply this patch manually https://github.com/pimcore/customer-data-framework/commit/4e0105c3a78d20686a0c010faef27d2297b98803.patch

### Workarounds Apply patch https://github.com/pimcore/customer-data-framework/commit/4e0105c3a78d20686a0c010faef27d2297b98803.patch manually.

### References https://huntr.dev/bounties/821ff465-4754-42d1-9376-813c17f16a01/

 https://cve.radiocsirt.org/vuln/gsd-2023-2629 gsd-2023-2629 2026-10-08T05:40:01.593547+00:00 gsd-2023-2629