# CVE-2026-47693: Poweradmin CSV Injection in log export functionality

Source: https://junglewise.ai/threats/cve-2026-47693-poweradmin-csv-injection-in-log-export-functionality  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-23. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2026-47693 · Severity: medium · CVSS 6.9 · Published 2026-06-23

Poweradmin is a web-based management tool for PowerDNS servers. A vulnerability in its log export feature allows malicious users to insert spreadsheet formulas into their usernames. When an administrator exports these logs and opens them in software like Excel or Google Sheets, the formulas execute automatically, which could lead to the theft of sensitive data or the redirection of the administrator to malicious websites.

Technologies: [Poweradmin](https://junglewise.ai/threats/technologies/poweradmin). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Poweradmin](https://junglewise.ai/threats/vendors/poweradmin).

## Quick answers

**Is CVE-2026-47693 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47693 being exploited in the wild.

**How severe is CVE-2026-47693?** Medium severity, with a CVSS score of 6.9, published 23 June 2026.

**Which products and versions are affected?** poweradmin/poweradmin (Packagist) ECOSYSTEM:introduced=0,fixed=4.2.4; Poweradmin < 4.2.4, >= 4.3.0 < 4.3.3.

**Is there a fix for CVE-2026-47693?** Yes. poweradmin/poweradmin (Packagist): upgrade to 4.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47693 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-47693?** Check whether you run poweradmin/poweradmin (Packagist) or Poweradmin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- poweradmin/poweradmin (Packagist): upgrade to 4.2.4 or later

  ```sh
  composer require poweradmin/poweradmin:^4.2.4
  ```


## Technical details

Poweradmin versions prior to 4.2.4 and 4.3.3 are vulnerable to CSV Injection (CWE-1236) within the log export controllers (e.g., ListLogUsersController.php). The application uses fputcsv() to generate exports but fails to sanitize formula trigger characters (=, +, -, @) in the username field. An attacker with 'user_add_new' permissions can create a user with a malicious formula as a username. When an administrator exports activity logs and opens the resulting CSV in a spreadsheet application (Excel, LibreOffice Calc, Google Sheets), the formula executes. This can be leveraged for data exfiltration via functions like IMPORTXML or for phishing via HYPERLINK. The issue is patched in versions 4.2.4 and 4.3.3.

## Affected products

- poweradmin Poweradmin < 4.2.4, >= 4.3.0 < 4.3.3

## Identifiers

- CVE-2026-47693
- GHSA-3h6h-67x3-cv5x

## Timeline

- 2026-06-07: patched: Versions 4.2.4 and 4.3.3 released
- 2026-06-23: disclosed: Public advisory published

## References

- [https://github.com/poweradmin/poweradmin/releases/tag/v4.2.4](https://github.com/poweradmin/poweradmin/releases/tag/v4.2.4)
- [https://github.com/poweradmin/poweradmin/releases/tag/v4.3.3](https://github.com/poweradmin/poweradmin/releases/tag/v4.3.3)
- [https://github.com/poweradmin/poweradmin/security/advisories/GHSA-3h6h-67x3-cv5x](https://github.com/poweradmin/poweradmin/security/advisories/GHSA-3h6h-67x3-cv5x)

## Related threats

- [Poweradmin account takeover via OIDC subject collation bypass](https://junglewise.ai/threats/poweradmin-account-takeover-via-oidc-subject-collation-bypass-0bbe481c)
- [Poweradmin IDOR in DNS record editing](https://junglewise.ai/threats/poweradmin-idor-in-dns-record-editing-fefaa5e3)
- [Poweradmin privilege escalation via API user-update endpoint](https://junglewise.ai/threats/poweradmin-privilege-escalation-via-api-user-update-endpoint-5c29340c)
- [Poweradmin Host Header Injection in OIDC and SAML flows](https://junglewise.ai/threats/cve-2026-54588-poweradmin-host-header-injection-in-oidc-and-saml-flows)