bagisto has CSV Formula Injection in Create New Product

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

9.0 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

EPSS

• CVE-2025-62417: 0.39% estimated exploitation activity in the next 30 days; percentile 33.38 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary When product data that begins with a spreadsheet formula character (for example =, +, -, or @) is accepted and later exported or saved into a CSV and opened in spreadsheet software, the spreadsheet will interpret that cell as a formula. This allows an attacker to supply a CSV field (e.g., product name) that contains a formula which may be evaluated by a victim’s spreadsheet application — potentially leading to data exfiltration and remote command execution (via older Excel exploits / OLE/cmd constructs or Excel macros). Details Spreadsheet applications treat cell text that begins with characters =, +, -, @ as formulas. If unescaped, spreadsheet will interpret and evaluate the content when the file is opened. The application fails to neutralize/escape leading formula characters when generating CSV or when accepting CSV import fields for display/export. PoC Insert CSV formula to the product name field, and save the changes. Export it to CSV file, open it and the calc.exe will…

Published by the source

16 Oct 2025, 20:48 UTC

Last modified by the source

16 Oct 2025, 20:48 UTC

Source last checked

26 Oct 2026, 14:34 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-jqrp-58fv-w8cq

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2025-62417

Advisory: bagisto has CSV Formula Injection in Create New Product
IDs: CVE-2025-62417, GHSA-jqrp-58fv-w8cq
Record: https://patchnext.com/advisories/cve-2025-62417 (revision 1, source checked 26 Oct 2026, 14:34 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Critical (CVSS 9.0)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: bagisto/bagisto 2.3.8. A vendor fix does not mean a deployment is fixed.

## Affected components
- Packagist bagisto/bagisto: affected <= 2.3.7; fixed in 2.3.8

## Suggested inspection (read-only)
- Packagist bagisto/bagisto: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on bagisto/bagisto.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-jqrp-58fv-w8cq (GitHub-reviewed advisory GHSA-jqrp-58fv-w8cq lists affected ranges: Packagist bagisto/bagisto >=0 <=2.3.7)

Commands are suggestions: review each one before running it.