iCagenda EUVD-2026-112025

Exploitation requires an attacker to submit an iCagenda event registration containing a spreadsheet-formula payload (a field value beginning with =, +, -, @, or similar) which iCagenda stores and later writes unescaped into the registrations CSV export. The attack chain completes ONLY when an administrator (1) exports the registrations to CSV and (2) opens that CSV in a spreadsheet application AND (3) dismisses or ignores the application's formula/DDE/external-content warning; without this administrator interaction the formula never executes. Limiting factors: dependence on admin-initiated export and file opening, reliance on the admin bypassing built-in spreadsheet warnings (blocked by default in current Excel/LibreOffice), and the fact that the web application itself suffers no confidentiality/integrity/availability impact (impact lands on the operator's workstation). Affected versions: iCagenda 3.5.0 through 4.0.16.

This is a medium-severity, lower-priority issue rather than an emergency. The input CVSS 4.0 score is 5.3 with VC:N/VI:N/VA:N, meaning there is no direct impact on the iCagenda/Joomla web application itself; the only impact is on the subsequent system (SC:L/SI:L/SA:L) - the administrator's workstation when a malicious formula executes in a spreadsheet. The vuln.today decision label is 'this_month', not 'act_now' or 'emergency', consistent with a stored CSV formula injection that depends heavily on victim behavior. No EPSS score, no CISA KEV listing, and no PoC were provided (the single reference is the vendor homepage https://www.icagenda.com/, not an advisory or exploit), so exploitation status is: no public exploit identified at time of analysis. The practical risk is gated by an administrator exporting registrations, opening the CSV in a spreadsheet, and dismissing the application's formula/DDE warning - modern spreadsheet software blocks this by default. One data tension to verify: the input CVSS uses UI:N, but CWE-1236 formula injection inherently requires an administrator to open the exported file, so meaningful impact realistically requires user interaction - verify intended attack model with the Joomla security team.

An attacker enters a spreadsheet formula (for example a field starting with =, +, -, or @) into an iCagenda event registration field, and the value is stored and later written unescaped into the registrations CSV export. When an administrator exports the registrations and opens the file in Excel, LibreOffice Calc, or similar and dismisses the formula/DDE warning, the formula executes in the context of the admin's workstation. No public exploit was identified at time of analysis; the attack requires network submission (AV:N) but completes only through administrator interaction with the exported file.