Vulnerabilities

Vulnerability · CVE-2026-45263

FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export

Published Jul 14, 2026 · catalog updated Nov 2, 2026 · FacturaScripts: CSV formula injection

Last checked Nov 6, 2026. A connected source was read within the last 7 days.

Open the advisory

Exploitation likelihood is not on this record for CVE-2026-45263. A missing EPSS score is not a low risk. Compare FacturaScripts: CSV formula injection with the linked advisory before you change production.

Severity

High8.0

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

Not in the current FIRST EPSS dataset

Remediation

Advisory link

Affected products

Packagist facturascripts/facturascripts

## Summary > **Live PoC verified 2026-04-30** against a stock FacturaScripts master at . A low-privilege user ( ) created a customer with . An admin then exported to CSV via . The downloaded file contains the raw payload as the first cell of the column, with no leading single quote and no escape. Excel and LibreOffice will execute the formula on open, including DDE invocations such as that spawn arbitrary processes on the admin workstation. wraps every cell in the configured delimiter ( ) and concatenates without inspecting the first character of the value. Spreadsheet applications interpret a cell that starts with , , , , , or as a formula. Because FacturaScripts only sanitises HTML metacharacters ( ) on save via ( ), the formula prefix characters survive untouched all the way to the export. The downstream consumer is the admin who triggered the export, giving the attacker a reliable handoff: low-priv user plants a payload in any text field that ships in the default list export, admin downloads the CSV (all normal billing/sales/purchasing workflow), and the admin's spreadsheet client runs the formula in the admin's local context. ## Details ### the export does not neutralise leading meta-characters : A string cell is rendered as . There is no check for the formula trigger characters ( per OWASP CSV-injection guidance) and no leading single-quote guard that Excel and LibreOffice both treat as "force as text". The same writer is reused for every list and document export through , , , and . ### the upstream sanitiser only scrubs HTML, not formulas : is the canonical input filter that models call from their method (e.g. at ). It strips angle brackets and quotes, none of which collide with the formula-injection alphabet. As a result, the , , , characters reach storage verbatim and the export pipeline emits them verbatim. ### the export controller hands the payload back to whoever triggers it : plus an extension causes browsers to save the file. Double-clicking the downl