TI-2026-35197 Aliases CVE-2026-47693 GHSA-3h6h-67x3-cv5x

Poweradmin: CSV Injection in log export endpoints allows formula execution in spreadsheet applications

MEDIUM 64CWE-1236Published 2026-06-23 · Updated 2026-06-24

Key facts

Attack vector: Network
Privileges required: High
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 are vulnerable to CSV Injection (Formula Injection) in its log export functionality. User-controlled data — specifically the username field — is written to exported CSV files without sanitizing formula trigger characters (=, +, -, @). When an administrator exports activity logs and opens the resulting CSV in a spreadsheet application (Microsoft Excel, LibreOffice Calc, Google Sheets), any formula stored in a username is executed by the application. This can be used for phishing attacks against administrators or data exfiltration. Versions 4.2.4 and 4.3.3 patch the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00375 31st percentileScored 2026-11-07

Fix Fixed poweradmin (poweradmin): 4.2.4, 4.3.3poweradmin/poweradmin (Packagist): 4.2.4, 4.3.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
poweradmin	poweradmin	before 4.2.4; 4.3.0 to before 4.3.3	4.2.4, 4.3.3	Patch available	CNA
—	poweradmin/poweradmin (Packagist)	before 4.2.4	4.2.4	Patch available	GHSA-3h6h-67x3-cv5x
—	poweradmin/poweradmin (Packagist)	4.3.0 to before 4.3.3	4.3.3	Patch available	GHSA-3h6h-67x3-cv5x

poweradmin Vendorpoweradmin Affected before 4.2.4; 4.3.0 to before 4.3.3 Fixed in 4.2.4, 4.3.3 Patch available CNA
poweradmin/poweradmin (Packagist) Vendor— Affected before 4.2.4 Fixed in 4.2.4 Patch available GHSA-3h6h-67x3-cv5x
poweradmin/poweradmin (Packagist) Vendor— Affected 4.3.0 to before 4.3.3 Fixed in 4.3.3 Patch available GHSA-3h6h-67x3-cv5x

Remediation

Fix · CNA poweradmin (poweradmin) Fixed in 4.2.4, 4.3.3
Fix · GHSA-3h6h-67x3-cv5x poweradmin/poweradmin (Packagist) Fixed in 4.2.4 Advisory →
Fix · GHSA-3h6h-67x3-cv5x poweradmin/poweradmin (Packagist) Fixed in 4.3.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-47693
2026-10-03 Alias added: GHSA-3h6h-67x3-cv5x

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-47693

Other 4

TI-2026-39423 Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction. CVSS 3.1CRITICAL 9.6
TI-2021-08462 A cross-site scripting (XSS) vulnerability in Power Admin PA Server Monitor 8.2.1.1… CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences