{"items":[{"id":"NVI-00007190","kind":"vulnerability","title":"C5 Firefly III CSV Injection.","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-29w6-c52g-m8jc"],"plain_summary":"OSV carries this publisher advisory for grumpydictator/firefly-iii. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 6.1.7 for grumpydictator/firefly-iii. Confirm the publisher’s latest guidance.","source_ids":["sr-d287a8d1564afc4a7b3b13d23a782ebd"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-d287a8d1564afc4a7b3b13d23a782ebd","url":"https://github.com/advisories/GHSA-29w6-c52g-m8jc","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-29w6-c52g-m8jc","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:40.014Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-d287a8d1564afc4a7b3b13d23a782ebd"],"technology":"grumpydictator/firefly-iii","known_exclusions":[],"conditions_summary":"### Summary\nCSV injection is a vulnerability where untrusted user input in CSV files can lead to unauthorized access or data manipulation. \nIn my subsequent testing of the application.\n\n### Details\nI discovered that there is an option to \"Export Data\" from the web app to your personal computer, which exports a \"csv\" file that can be opened with Excel software that supports macros.\n\nP.S \nI discovered that the web application's is offering a demo-site that anyone may access to play with the web application. So, there's a chance that someone will export the data (CVS) from the demo site and execute it on their PC, giving the malicious actor a complete control over their machine. (if a user enters a malicious payload to the website).\n\n### PoC\nYou can check out my vulnerability report if you need more details/PoC with screenshots: (removed by JC5)\n\n### Impact\nAn attacker can exploit this by entering a specially crafted payload to one of the fields, and when a user export the csv file using the \"Export Data\" function, the attacker can potentiality can RCE.\n\n### Addendum by JC5, the developer of Firefly III\nThere is zero impact on normal users, even on vulnerable versions.","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 6.1.7"]}],"null_published_at":"2026-10-31T22:13:14.316Z","source_updated_at":"2024-12-06T05:33:33.243Z","source_disclosed_at":"2024-01-31T18:05:46.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:41:40.014Z"}],"next_cursor":null,"snapshot_revision":"40769"}