Thelia CVE-2026-109396

Exploitation requires that an administrator export customer, order, or newsletter/mailing data via Thelia's CSV export (CSVSerializer) and then open the resulting file in a spreadsheet application (Excel, LibreOffice Calc, Google Sheets) that evaluates leading-'=','+','-','@' cells as formulas. The injection vector is unauthenticated: any visitor can supply crafted values through registration, checkout, or newsletter fields that begin with those trigger characters. Limiting factors that reduce real-world risk: the payload lies dormant until an admin performs both the export and the open action (UI:R/AT:P), modern spreadsheet applications display a warning before executing external/dynamic formulas, and impact is confined to the administrator's client workstation rather than the Thelia server. Affected only before 3.1.2 and 3.2.0 through 3.2.0 (fixed in 3.2.1).

This is a genuinely low-priority issue, and the available signals are consistent on that point. The only numeric signal provided is the vendor/VulnCheck CVSS 4.0 vector (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P), scored 2.3 (Low). While AV:N and PR:N look alarming in isolation (a remote, unauthenticated attacker can inject the payload), the AC:H, AT:P and UI:P metrics correctly capture that code never executes on the Thelia server - it executes only if and when an administrator exports customer/order/newsletter data to CSV and opens it in a spreadsheet application that evaluates the formula. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no public POC is referenced, so this is no public exploit identified at time of analysis. CWE-1236 (formula injection) combined with the confirmed patch commits supports the technical description. There is no conflict between the signals: this is a low-CVSS, low-real-risk, operator-dependent weakness rather than a server-side RCE. The one nuance to verify is that impact is entirely client-side on the administrator's workstation, not on the e-commerce platform itself - raw AV:N can mislead triage tooling into over-prioritizing it.

An unauthenticated visitor registers an account, places an order, or subscribes to the newsletter, entering a value such as '=cmd|'/C calc'!A1' or '@SUM(...)' into a name, address or phone field. Later, a store administrator exports the customer, order or mailing list to CSV and opens it in Excel or LibreOffice, at which point the spreadsheet interprets the cell as a formula and may run it, enabling data exfiltration (e.g. via auto-executed hyperlinks) or command execution on the admin's workstation. No public exploit code is referenced, and the attack depends on the admin both exporting and opening the file in a formula-evaluating application.