CSV Injection Vulnerability in Alkacon OpenCMS (org.opencms:opencms-core) - High Risk
Summary
CVE-2019-11819: Alkacon OpenCMS CSV Injection via New User module. Affects org.opencms:opencms-core versions < 11.0.0. Fixed in 11.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Alkacon OpenCMS is a powerful open-source content management system (CMS) that allows users to create, manage, and publish digital content. It is widely used for building websites and applications due to its flexibility and extensibility. The system includes various modules for user management, including the New User module, which is responsible for creating new user accounts. However, versions 10.5.4 and earlier are susceptible to a CSV injection vulnerability that can be exploited through user input fields.
Vulnerability Detail
The vulnerability arises from improper handling of user input in the New User module, specifically in the First Name and Last Name fields. An attacker can inject malicious CSV content that, when processed by spreadsheet applications like Microsoft Excel, could execute arbitrary commands or macros. This poses a significant risk as it can lead to data manipulation, unauthorized access, and potential system compromise. The vulnerability is classified under CWE-1236, indicating a high severity level with a CVSS score of 7.8.
How To Fix
Latest published version: 22.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to sanitize user inputs in the First Name and Last Name fields to prevent the injection of malicious CSV content. This can be done by stripping out any special characters or validating input against a whitelist of acceptable characters.
Conclusion
The CSV injection vulnerability in Alkacon OpenCMS poses a significant risk to users of versions 10.5.4 and earlier. It is crucial to update to version 11.0.0 or later to mitigate this risk. Additionally, implementing input validation can serve as a temporary workaround while transitioning to the patched version.
See every vulnerability recorded for org.opencms:opencms-core →
FAQ
CSV injection occurs when an attacker is able to inject malicious content into CSV files, which can be executed by spreadsheet applications, potentially leading to data breaches or unauthorized actions.
If you are using Alkacon OpenCMS version 10.5.4 or earlier, your installation is vulnerable to this CSV injection issue.
Exploitation of this vulnerability can lead to unauthorized access, data manipulation, and execution of arbitrary commands through spreadsheet applications.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing the pom.xml file. You can check for vulnerabilities in your application using the Vulert playground without any signup.
If updating is not feasible, implement input validation and sanitization as a temporary measure to mitigate the risk of CSV injection.
Related vulnerabilities
Recent vulnerabilities recorded for org.opencms:opencms-core.
