CVE-2026-102799: iCagenda CSV formula injection in registrations export

CVE-2026-102799 · Severity: info · Published 2026-10-28

iCagenda is an events management extension for the Joomla CMS that allows administrators to create and manage calendar events. A CSV formula injection vulnerability in the registrations export feature could allow an attacker with access to registration data to inject malicious formulas that execute when the export file is opened in a spreadsheet application, potentially leading to data theft or further compromise.

Vendors: Joomlic.

Quick answers

Is CVE-2026-102799 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-102799 being exploited in the wild.
How severe is CVE-2026-102799?
Informational severity, published 28 October 2026.
Which products and versions are affected?
Joomlic Icagenda 3.5.0 to 4.0.16.
Is there a fix for CVE-2026-102799?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-102799 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-102799?
Check whether you run Joomlic Icagenda at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

CSV formula injection occurs when untrusted data containing formula prefixes (=, +, -, @) is exported to CSV format without sanitization. When opened in spreadsheet applications like Excel, these formulas are automatically executed. The vulnerability affects iCagenda's registrations export feature in versions 3.5.0 through 4.0.16, allowing an attacker to craft malicious registration data that executes arbitrary functions upon export viewing.

Affected products

  • JoomliC iCagenda 3.5.0 to 4.0.16

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.