CVE-2026-73195 Apache Syncope: CSV export spreadsheet formula injection
Authenticated users can inject spreadsheet formulas into CSV exports, leading to code execution when the file is opened in a spreadsheet application.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-73195?
CVE-2026-73195 is a high-severity vulnerability in Apache Syncope, published on 14 Sep 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Improper Encoding or Escaping of Output vulnerability in Apache Syncope.
Authenticated users can store a spreadsheet formula payload in one of their own plain attributes. When such users are included in a CSV export and the generated CSV file is opened by a spreadsheet application, the formula may be executed.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.
Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
Weakness: CWE-116
Which versions are affected by CVE-2026-73195?
How do I fix CVE-2026-73195?
No fix has been published for CVE-2026-73195 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-73195 being exploited?
There is no known exploitation of CVE-2026-73195 in the wild and no public exploit code.
Sources
Also known as GHSA-3gg5-c8gj-frxr.