Read the docs
TI-2026-19231 Aliases CVE-2026-23873

HUSTOJ is Vulnerable to Stored CSV Injection (Formula Injection) in Contest Rank Export

Priority MEDIUM 57CWE-1236Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

hustoj is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. All versions are vulnerable to CSV Injection (Formula Injection) through the contest rank export functionality (contestrank.xls.php and admin/ranklist_export.php). The application fails to sanitize user-supplied input (specifically the "Nickname" field) before exporting it to an .xls file (which renders as an HTML table but is opened by Excel). If a malicious user sets their nickname to an Excel formula when an administrator exports and opens the rank list in Microsoft Excel, the formula will be executed. This can lead to arbitrary command execution (RCE) on the administrator's machine or data exfiltration. A fix was not available at the time of publication.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00569 47th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
zhbluehustojup to 26.01.01—No fix listedCNA
  • hustoj Vendorzhblue Affected up to 26.01.01 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:hustoj:hustoj:*:*:*:*:*:*:*:*up to 26.01.31VulnerableHustoj
  • cpe:2.3:a:hustoj:hustoj:*:*:*:*:*:*:*:* Versions up to 26.01.31 Vulnerable ·Hustoj

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-23873

References

Exploit 1

  • TI-2025-32272 Cross site scripting (XSS) vulnerability in Hustoj 2025-01-31 via the TID parameter to thread.php. CVSS 3.1MEDIUM 6.1
  • TI-2022-20442 Hustoj 22.09.22 has a XSS Vulnerability in /admin/problem_judge.php. CVSS 3.1MEDIUM 6.1
  • TI-2026-19733 HUSTOJ has Arbitrary File Write (Zip Slip) in Problem Import Modules that leads to RCE CVSS 4.0CRITICAL 9.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences