Medium severity · published Jun 22, 2026
CVE-2026-12862
XLSX formula injection in exports
5.1
CVSS
0.4%
EPSS
No
On KEV
Description
Untrusted user data was passed verbatim to Excel exports for administrators. This allowed formula injection which can be used to compromise the environment of the user loading the file or other data in the file.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VE
Venueless · pretix
0.0.0 before 0a35457f · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-12862
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-12862
github.com
https://github.com/venueless/venueless/security/advisories/GHSA-5hw3-655h-7m86
More from Venueless
7.3
CVE-2026-5599
API allows deletion of users of other instance
7.3
CVE-2026-4982
Unauthorized access to chat contents
6.4
CVE-2026-82838
Default webserver configuration with incorrect CSP
5.1
CVE-2026-12863
Open redirect
2.3
CVE-2026-13350
Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create