Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Joomla! CSV export can run malicious code

CVE-2019-12765 · published 7 years ago
Summary

When Joomla! versions before 3.9.7 generate a CSV file from the actions log, an attacker can insert specially crafted data that executes when the file is opened in a spreadsheet program. This could let the attacker run commands on a user’s computer or steal information. Upgrade Joomla! to version 3.9.7 or later, or avoid opening exported CSV files from untrusted sources.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
joomla joomla\! >= 3.9.0, <= 3.9.6
cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*
Original advisory text
An issue was discovered in Joomla! before 3.9.7. The CSV export of com_actionslogs is vulnerable to CSV injection.
An issue was discovered in Joomla! before 3.9.7. The CSV export of com_actionslogs is vulnerable to CSV injection.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
10% chance of attack within 30 days
Type
CWE-1236Improper Neutralization of Formula Elements in a CSV File
Timeline
Published11 Jun 2019
Updated16 Oct 2026
First seen29 Sep 2026
Sources
CVE-2019-12765 · NVD
Track software like this
Free during beta