-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability specifically affects the Periods Module's CSV export functionality. CSV injection typically occurs when: 1) User-controlled data is included in CSV cells without proper escaping 2) The export function doesn't neutralize formula characters. While exact code isn't available, the pattern suggests the Periods CSV export handler (likely named PeriodsCSV) fails to implement CSV field sanitization through quoting or escaping dangerous initial characters. This matches CWE-1236's description of improper formula neutralization in CSVs.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| francoisjacquet/rosariosis | composer | <= 10.8.4 |
Ongoing coverage of React2Shell