# CVE-2026-45263: FacturaScripts CSV formula injection in CSVExport

Source: https://junglewise.ai/threats/cve-2026-45263-facturascripts-csv-formula-injection-in-csvexport  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-45263 · Severity: high · CVSS 8 · Published 2026-07-14

FacturaScripts is an open-source ERP and accounting system. A vulnerability in its CSV export feature allows low-privileged users (such as sales or accounting staff) to inject malicious formulas into data fields like customer names or product descriptions. When an administrator later exports this data to a CSV file and opens it in a spreadsheet application like Excel or LibreOffice, the malicious code can execute on the administrator's computer, potentially leading to full system takeover or data theft.

Technologies: [NeoRazorX FacturaScripts](https://junglewise.ai/threats/technologies/facturascripts), [facturascripts/facturascripts (Packagist)](https://junglewise.ai/threats/technologies/facturascripts-facturascripts). Vendors: [NeoRazorX](https://junglewise.ai/threats/vendors/neorazorx), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-45263 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45263 being exploited in the wild.

**How severe is CVE-2026-45263?** High severity, with a CVSS score of 8, published 14 July 2026.

**Which products and versions are affected?** NeoRazorX FacturaScripts <= 2026.1; facturascripts/facturascripts (Packagist) <= 2026.1, ECOSYSTEM:introduced=0,last_affected=2026.1.

**Is there a fix for CVE-2026-45263?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-45263 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-45263?** Check whether you run NeoRazorX FacturaScripts or facturascripts/facturascripts (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A CSV formula injection vulnerability exists in FacturaScripts due to insufficient sanitization of leading characters in the CSVExport class. The `CSVExport::writeData()` method in `Core/Lib/Export/CSVExport.php` fails to neutralize characters that trigger formula execution in spreadsheet software (e.g., `=`, `+`, `-`, `@`). While the application sanitizes HTML characters, it does not address spreadsheet meta-characters. An authenticated low-privileged attacker can input a malicious payload (such as a DDE command) into a model field (e.g., Cliente, Producto). When an administrator triggers a CSV export via the `?action=export&option=CSV` controller, the payload is included verbatim. Opening the resulting file in Excel or LibreOffice can lead to arbitrary command execution or data exfiltration from the administrator's workstation.

## Affected products

- NeoRazorX FacturaScripts <= 2026.1

## Identifiers

- CVE-2026-45263
- GHSA-2p5x-4jr6-x5jg

## Timeline

- 2026-04-30: other: PoC verified against master branch
- 2026-07-14: advisory: GitHub Advisory published

## References

- [https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-2p5x-4jr6-x5jg](https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-2p5x-4jr6-x5jg)
- [https://api.github.com/repos/NeoRazorX/facturascripts/security-advisories/GHSA-2p5x-4jr6-x5jg](https://api.github.com/repos/NeoRazorX/facturascripts/security-advisories/GHSA-2p5x-4jr6-x5jg)

## Related threats

- [FacturaScripts PHP object injection in WidgetSelect](https://junglewise.ai/threats/cve-2026-104905-facturascripts-before-version-2026-7-contains-a-php-object)
- [FacturaScripts path traversal and RCE in UploadedFile move](https://junglewise.ai/threats/facturascripts-path-traversal-and-rce-in-uploadedfile-move-40e5093b)
- [FacturaScripts stored XSS in WidgetVariante and WidgetSubcuenta](https://junglewise.ai/threats/cve-2026-45710-facturascripts-stored-xss-in-widgetvariante-and-widgetsubcuenta)
- [FacturaScripts path traversal in static file controllers](https://junglewise.ai/threats/cve-2026-45693-facturascripts-path-traversal-in-static-file-controllers)
- [FacturaScripts SQL injection in REST API filter parameter](https://junglewise.ai/threats/cve-2026-45262-facturascripts-sql-injection-in-rest-api-filter-parameter)