CVE-2025-22978

The vulnerability classified as CWE-74 (Injection) involves insufficient sanitization of data written to CSV files generated by the exception logs module. An attacker can inject data containing special characters (such as =, +, -, @) at the beginning of field values, which spreadsheet applications (such as Microsoft Excel or LibreOffice Calc) interpret as formulas. After downloading and opening such a file by a user (e.g., an administrator), the malicious formula can be executed in the context of their workstation.

An attacker can cause malicious code to be executed on the computer of a user opening an infected CSV file, which may result in data theft, session hijacking, or system compromise.

Patches available from the vendor should be applied according to the references — the fix was introduced in commit d6a16e9afc0a3b96a56f1a24ed167e1beec6ce2f available in the Eladmin project GitHub repository.

Eladmin version 2.7 and all earlier versions.