Wger Project
Monthly
Uncontrolled resource consumption in wger before 2.5 allows any authenticated user to exhaust server worker threads and deny service to all legitimate users. By creating a routine with an arbitrarily long date range (e.g., 100 years spanning 2000-2099) and then triggering the unbounded `date_sequence` while-loop via any of five routine detail REST endpoints, a single HTTP request forces 36,525 per-day iterations - each performing O(slots × entries × configs) computation - consuming multiple seconds of CPU. No public exploit code has been released independently, though the GHSA advisory itself contains a complete, weaponizable step-by-step PoC including exact API payloads.
CSV/TSV formula injection in wger's gym member export endpoint allows any authenticated gym member to pre-load spreadsheet formulas into their own first_name or last_name profile fields, which are then reproduced verbatim in the TSV export file. When a gym administrator opens the exported file in Excel, LibreOffice Calc, or Google Sheets, the formula executes in the admin's local spreadsheet context, enabling data exfiltration via =HYPERLINK callbacks and, on legacy Excel deployments with DDE enabled, arbitrary local code execution. No public exploit code has been independently verified beyond the researcher's proof-of-concept described in the GHSA advisory; this vulnerability is not listed in the CISA KEV catalog.
Open redirect in wger's trainer_login view allows an attacker to redirect an authenticated trainer's browser to an arbitrary external domain immediately after impersonation mode is established. The root cause is in `wger/core/views/user.py` (~line 203), where `HttpResponseRedirect(request.GET['next'])` is called without invoking Django's `url_has_allowed_host_and_scheme()` guard, allowing any URL - including off-host ones - to be supplied via the `?next=` GET parameter. Beyond phishing, the redirect leaks the wger instance URL structure and the impersonated user's `user_pk` through the browser's Referer header; a working PoC is confirmed in the GHSA advisory, though no active exploitation has been reported.
Incomplete authorization fix in wger through master exposes three user-management views in wger/core/views/user.py to the same None != None gym-scope bypass previously identified in CVE-2026-43948 (GHSA-mhc8-p3jx-84mm). A gym staff member holding gym.manage_gym permission whose account has gym=None - the default unlinked state for any newly provisioned staff account - can permanently delete, deactivate, or re-activate any other user also carrying gym=None, exploiting a raw integer comparison that evaluates None != None as False instead of blocking the operation. No vendor-released patch has been identified at time of analysis; all wger versions through the master Docker image build of 2026-05-08 are confirmed affected.
Cross-site request forgery in wger's gym password-reset endpoint allows a remote attacker to force an arbitrary member's password to be reset by tricking an authenticated trainer or admin into loading a malicious URL. The vulnerable `reset_user_password` view in `wger/gym/views/gym.py` performed its state-changing operation via HTTP GET, which Django's CSRF middleware does not protect by design. The upstream fix - commit 3c6ce4b7f3eeafeb35318c6c4e82b1a3fd28b314 - converts the action to a POST-based confirmation form with full CSRF token enforcement; no public exploit and no CISA KEV listing have been identified at time of analysis.
Uncontrolled resource consumption in wger before 2.5 allows any authenticated user to exhaust server worker threads and deny service to all legitimate users. By creating a routine with an arbitrarily long date range (e.g., 100 years spanning 2000-2099) and then triggering the unbounded `date_sequence` while-loop via any of five routine detail REST endpoints, a single HTTP request forces 36,525 per-day iterations - each performing O(slots × entries × configs) computation - consuming multiple seconds of CPU. No public exploit code has been released independently, though the GHSA advisory itself contains a complete, weaponizable step-by-step PoC including exact API payloads.
CSV/TSV formula injection in wger's gym member export endpoint allows any authenticated gym member to pre-load spreadsheet formulas into their own first_name or last_name profile fields, which are then reproduced verbatim in the TSV export file. When a gym administrator opens the exported file in Excel, LibreOffice Calc, or Google Sheets, the formula executes in the admin's local spreadsheet context, enabling data exfiltration via =HYPERLINK callbacks and, on legacy Excel deployments with DDE enabled, arbitrary local code execution. No public exploit code has been independently verified beyond the researcher's proof-of-concept described in the GHSA advisory; this vulnerability is not listed in the CISA KEV catalog.
Open redirect in wger's trainer_login view allows an attacker to redirect an authenticated trainer's browser to an arbitrary external domain immediately after impersonation mode is established. The root cause is in `wger/core/views/user.py` (~line 203), where `HttpResponseRedirect(request.GET['next'])` is called without invoking Django's `url_has_allowed_host_and_scheme()` guard, allowing any URL - including off-host ones - to be supplied via the `?next=` GET parameter. Beyond phishing, the redirect leaks the wger instance URL structure and the impersonated user's `user_pk` through the browser's Referer header; a working PoC is confirmed in the GHSA advisory, though no active exploitation has been reported.
Incomplete authorization fix in wger through master exposes three user-management views in wger/core/views/user.py to the same None != None gym-scope bypass previously identified in CVE-2026-43948 (GHSA-mhc8-p3jx-84mm). A gym staff member holding gym.manage_gym permission whose account has gym=None - the default unlinked state for any newly provisioned staff account - can permanently delete, deactivate, or re-activate any other user also carrying gym=None, exploiting a raw integer comparison that evaluates None != None as False instead of blocking the operation. No vendor-released patch has been identified at time of analysis; all wger versions through the master Docker image build of 2026-05-08 are confirmed affected.
Cross-site request forgery in wger's gym password-reset endpoint allows a remote attacker to force an arbitrary member's password to be reset by tricking an authenticated trainer or admin into loading a malicious URL. The vulnerable `reset_user_password` view in `wger/gym/views/gym.py` performed its state-changing operation via HTTP GET, which Django's CSRF middleware does not protect by design. The upstream fix - commit 3c6ce4b7f3eeafeb35318c6c4e82b1a3fd28b314 - converts the action to a POST-based confirmation form with full CSRF token enforcement; no public exploit and no CISA KEV listing have been identified at time of analysis.