Skip to content
Fencer Intel
critical 9.6

CVE-2018-15474 json

CSV Injection (aka Excel Macro Injection or Formula Injection) in /lib/plugins/usermanager/admin.php in DokuWiki 2018-04-22a and earlier al…

published 2018-09-07 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-7352

cvss
9.6
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.3%
EPSS 3.3% chance of exploitation in 30 days, percentile 88%
public exploits
0
none known

Summary

CSV Injection (aka Excel Macro Injection or Formula Injection) in /lib/plugins/usermanager/admin.php in DokuWiki 2018-04-22a and earlier allows remote attackers to exfiltrate sensitive data and to execute arbitrary code via a value that is mishandled in a CSV export. NOTE: the vendor has stated "this is not a security problem in DokuWiki.

Exploit prediction

3.33% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/splitbrain/dokuwiki/issues/2450 referenced PoC, tagged "exploit" by a source, unverified
  • sec-consult.com https://www.sec-consult.com/en/blog/advisories/dokuwiki-csv-formula-injection-vulnerability/ referenced PoC, tagged "exploit" by a source, unverified
  • seclists.org https://seclists.org/fulldisclosure/2018/Sep/4 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.0 9.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-1236 Improper Neutralization of Formula Elements in a CSV File

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.