CVE-2026-47693: Poweradmin CSV Injection in log export functionality

CVE-2026-47693 · Severity: medium · CVSS 6.9 · Published 2026-06-23

Poweradmin is a web-based management tool for PowerDNS servers. A vulnerability in its log export feature allows malicious users to insert spreadsheet formulas into their usernames. When an administrator exports these logs and opens them in software like Excel or Google Sheets, the formulas execute automatically, which could lead to the theft of sensitive data or the redirection of the administrator to malicious websites.

Technologies: Poweradmin. Vendors: Packagist, Poweradmin.

Quick answers

Is CVE-2026-47693 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47693 being exploited in the wild.
How severe is CVE-2026-47693?
Medium severity, with a CVSS score of 6.9, published 23 June 2026.
Which products and versions are affected?
poweradmin/poweradmin (Packagist) ECOSYSTEM:introduced=0,fixed=4.2.4; Poweradmin < 4.2.4, >= 4.3.0 < 4.3.3.
Is there a fix for CVE-2026-47693?
Yes. poweradmin/poweradmin (Packagist): upgrade to 4.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47693 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-47693?
Check whether you run poweradmin/poweradmin (Packagist) or Poweradmin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • poweradmin/poweradmin (Packagist): upgrade to 4.2.4 or later
    composer require poweradmin/poweradmin:^4.2.4

Technical details

Poweradmin versions prior to 4.2.4 and 4.3.3 are vulnerable to CSV Injection (CWE-1236) within the log export controllers (e.g., ListLogUsersController.php). The application uses fputcsv() to generate exports but fails to sanitize formula trigger characters (=, +, -, @) in the username field. An attacker with 'user_add_new' permissions can create a user with a malicious formula as a username. When an administrator exports activity logs and opens the resulting CSV in a spreadsheet application (Excel, LibreOffice Calc, Google Sheets), the formula executes. This can be leveraged for data exfiltration via functions like IMPORTXML or for phishing via HYPERLINK. The issue is patched in versions 4.2.4 and 4.3.3.

Affected products

  • poweradmin Poweradmin < 4.2.4, >= 4.3.0 < 4.3.3

Identifiers

  • CVE-2026-47693
  • GHSA-3h6h-67x3-cv5x

Timeline

  • 2026-06-07: patched: Versions 4.2.4 and 4.3.3 released
  • 2026-06-23: disclosed: Public advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.