Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.3

Apache Syncope CSV export can run malicious formulas

CVE-2026-73195 · published 1 month ago
Summary

When a logged‑in user adds a spreadsheet formula to their own data, that formula can be included in CSV files generated by Apache Syncope. If someone opens the exported CSV in a spreadsheet program, the formula may execute automatically. Upgrade Apache Syncope to version 4.0.8 or 4.1.3 to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
apache software foundation apache syncope <= 3.0.16
Original advisory text
Improper Encoding or Escaping of Output vulnerability in Apache Syncope. Authenticated users can store a spreadsheet formula payload in one of their own plain attributes. When such users are inc...
Improper Encoding or Escaping of Output vulnerability in Apache Syncope.



Authenticated users can store a spreadsheet formula payload in one of their own plain attributes. When such users are included in a CSV export and the generated CSV file is opened by a spreadsheet application, the formula may be executed.





This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.

Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.3 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-116Improper Encoding or Escaping of Output
Timeline
Published14 Sep 2026
Updated4 Nov 2026
First seen14 Sep 2026
Sources
CVE-2026-73195 · NVD
CVE-2026-73195 · MITRE
Track software like this
Free during beta