CVE-2026-86257: Wger-Project Wger

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or LibreOffice Calc.

Affected products

• Wger-Project Wger: before 2.6 (fixed in 2.6)

Published 2026-09-06. Last modified 2026-09-08.