CVE-2026-47693
Description
Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 are vulnerable to CSV Injection (Formula Injection) in its log export functionality. User-controlled data — specifically the username field — is written to exported CSV files without sanitizing formula trigger characters (=, +, -, @). When an administrator exports activity logs and opens the resulting CSV in a spreadsheet application (Microsoft Excel, LibreOffice Calc, Google Sheets), any formula stored in a username is executed by the application. This can be used for phishing attacks against administrators or data exfiltration. Versions 4.2.4 and 4.3.3 patch the issue.
Summary dbcve.org
Poweradmin versions prior to 4.2.4 and 4.3.3 are vulnerable to CSV Injection (Formula Injection) in the log export functionality. User-controlled usernames are written to exported CSV files without sanitizing formula trigger characters (=, +, -, @). When administrators open these CSV files in spreadsheet applications, any embedded formulas execute automatically, enabling phishing attacks or data exfiltration.
Mitigation
Upgrade to Poweradmin version 4.2.4 or 4.3.3 which patches the vulnerability by sanitizing formula trigger characters in exported data.