Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-16275: Opswat MetaDefender CSV files can execute commands

CVE-2018-16275 · published 8 years ago

Summary

The MetaDefender product lets users download CSV reports that can contain malicious formulas. When opened in spreadsheet software, these formulas can run code or steal data. Update to version 4.11.2 or later, or avoid opening CSV reports from untrusted sources.

What to do

Update opswat metadefender to version 4.11.2 or later.

Affected software

Vendor	Product	Affected versions
opswat	metadefender	< 4.11.2 `cpe:2.3:a:opswat:metadefender::::::::`

Original advisory text

OPSWAT MetaDefender before v4.11.2 allows CSV injection.

References

https://onlinehelp.opswat.com/corev4/10._Release_notes.html Release Notes Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-1236Improper Neutralization of Formula Elements in a CSV File

Timeline

Published31 Aug 2018

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2018-16275 · NVD

Track software like this

Free during beta