CVE-2026-47693 PUBLISHED

Poweradmin: CSV Injection in log export endpoints allows formula execution in spreadsheet applications

Assigner: GitHub_M
Reserved: 19.05.2026 Published: 23.06.2026 Updated: 24.06.2026

Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 are vulnerable to CSV Injection (Formula Injection) in its log export functionality. User-controlled data — specifically the username field — is written to exported CSV files without sanitizing formula trigger characters (=, +, -, @). When an administrator exports activity logs and opens the resulting CSV in a spreadsheet application (Microsoft Excel, LibreOffice Calc, Google Sheets), any formula stored in a username is executed by the application. This can be used for phishing attacks against administrators or data exfiltration. Versions 4.2.4 and 4.3.3 patch the issue.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N
CVSS Score: 6.9

Product Status

Vendor poweradmin
Product poweradmin
Versions
  • Version < 4.2.4 is affected
  • Version >= 4.3.0, < 4.3.3 is affected

References

Problem Types

  • CWE-1236: Improper Neutralization of Formula Elements in a CSV File CWE