What is the CVSS score of CVE-2025-66834?

CVE-2025-66834 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of TrueConf Server are affected by CVE-2025-66834?

TrueConf Server 5.5.2.10813 contains a formula injection vulnerability in CSV chat log exports that allows low-privileged authenticated users to embed malicious formulas which execute on…

Is there a public PoC exploit available for CVE-2025-66834?

Yes, a public proof-of-concept exploit is available for CVE-2025-66834. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2025-66834?

Within 24 hours: Identify and audit all TrueConf Server 5.5.2.10813 instances; restrict CSV export access to only essential administrators and notify them not to open exports without first inspecting the content in plain text. Within 7 days: Implement controls to flag or block suspicious display names containing formula syntax (=, +, -, @, tab characters), and audit recent export logs for evidence of exploitation. Within 30 days: Contact TrueConf for patched version availability and establish upgrade timeline; until a patch is released, require all administrators to open exported files in formula-safe applications such as Google Sheets or with formula evaluation disabled in Excel/LibreOffice via Group Policy.

TrueConf Server CVE-2025-66834

HIGH

Improper Neutralization of Formula Elements in a CSV File (CWE-1236)

2025-12-30 cve@mitre.org

Code Injection Trueconf Trueconf Server

7.3

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

vuln.today AI

7.3 HIGH

Low-privileged account required to inject (PR:L); victim must open the exported CSV in formula-evaluating software (UI:R); no availability impact results from formula injection.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 20, 2026 - 18:34 vuln.today

CVE Published

Dec 30, 2025 - 19:15 cve.org

HIGH 7.3

DescriptionCVE.org

A CSV Formula Injection vulnerability in TrueConf Server v5.5.2.10813 allows a normal user to inject malicious spreadsheet formulas into exported chat logs via crafted Display Name.

AnalysisAI

CSV formula injection in TrueConf Server 5.5.2.10813 on Windows allows an authenticated low-privileged user to embed malicious spreadsheet formulas into exported chat logs by setting a crafted Display Name. When an administrator or privileged user exports those chat logs to CSV and opens the file in spreadsheet software such as Microsoft Excel or LibreOffice Calc, the injected formula executes in the context of the victim's workstation, potentially enabling OS command execution or data exfiltration. A publicly available proof-of-concept exists; EPSS probability is low at 0.27% (20th percentile), and the vulnerability is not currently listed in the CISA KEV catalog.

Technical ContextAI

TrueConf Server (CPE: cpe:2.3:a:trueconf:trueconf_server:5.5.2.10813:*:*:*:*:windows:*:*) is a Windows-hosted video conferencing and collaboration platform. The vulnerability is classified as CWE-1236 (Improper Neutralization of Formula Elements in a CSV File). CSV formula injection - also known as formula injection or CSV injection - occurs when user-supplied input is written verbatim into a CSV export without stripping or escaping formula trigger characters (=, +, -, @, TAB, CR). Spreadsheet applications such as Microsoft Excel and LibreOffice Calc interpret these leading characters as active expressions and evaluate them on file open. Combined with Dynamic Data Exchange (DDE) calls or built-in functions like HYPERLINK(), this can result in OS command execution or data exfiltration originating on the victim's machine. In this case, the injection vector is the user-controlled Display Name field, which is persisted server-side and subsequently embedded verbatim in exported chat log CSV files.

RemediationAI

No specific patched version number is confirmed in the available reference data - consult the TrueConf vendor advisory at https://trueconf.com for the official fix release. As compensating controls, administrators should restrict Display Name modification to trusted or verified accounts via server policy, and disable the CSV export feature for chat logs if it is not operationally required, since removing the export capability eliminates the delivery mechanism entirely. Where CSV exports are necessary, open them only in sandboxed environments or purpose-built CSV viewers that do not evaluate spreadsheet formulas. For Microsoft Excel deployments, disable Dynamic Data Exchange (DDE) via Group Policy under Excel Trust Center > External Content settings, and enforce the 'Disable automatic update of workbook links' policy - note that some legitimate Excel features relying on DDE may be affected. The public proof-of-concept at https://github.com/x00nullbit/CVE-References/blob/main/CVE-2025-66834/README.md can be used to verify whether a given deployment is susceptible prior to patching.