Is CVE-2026-109396 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109396 being exploited in the wild.

How severe is CVE-2026-109396?

Medium severity, with a CVSS score of 4.2, published 12 October 2026.

Which products and versions are affected?

Thelia before 3.1.2, 3.2.x before 3.2.1.

Is there a fix for CVE-2026-109396?

Yes: fixed in Thelia 3.1.2, 3.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-109396 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-109396?

Check whether you run Thelia at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109396: Thelia CSV formula injection in exports

CVE-2026-109396 · Severity: medium · CVSS 4.2 · Published 2026-10-12

Thelia is an open-source e-commerce platform that exports customer data such as registration and checkout information to CSV files for administrative review. An unauthenticated attacker can inject spreadsheet formulas through registration, checkout, or newsletter form fields by using names or addresses starting with special characters (=, +, -, @), which are then executed when administrators open the exported CSV file in a spreadsheet application. This could lead to data theft, unauthorized spreadsheet operations, or local system compromise depending on the spreadsheet application's formula capabilities.

Technologies: Thelia. Vendors: Thelia.

Quick answers

Is CVE-2026-109396 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109396 being exploited in the wild.
How severe is CVE-2026-109396?: Medium severity, with a CVSS score of 4.2, published 12 October 2026.
Which products and versions are affected?: Thelia before 3.1.2, 3.2.x before 3.2.1.
Is there a fix for CVE-2026-109396?: Yes: fixed in Thelia 3.1.2, 3.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109396 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-109396?: Check whether you run Thelia at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Thelia 3.1.2, 3.2.1

Technical details

A CSV formula injection vulnerability exists in Thelia's CSVSerializer component, which fails to sanitize user-supplied data before exporting it to CSV format. Attackers can inject formulas starting with =, +, -, or @ through customer registration, checkout, or newsletter fields; when an administrator opens the exported CSV file in a spreadsheet application, these formulas are executed. The fix involves prefixing exported cells that would be interpreted as formulas with a single quote or similar escaping mechanism to force them to be treated as text.

Affected products

Thelia Thelia before 3.1.2, 3.2.x before 3.2.1

Timeline

2026-10-12: disclosed
2026-10-06: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.