CVE-2026-111038

CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform. The vulnerability arises because certain user-controlled data, such as event names or templates within the Tenders module, are not properly validated or sanitised before being included in CSV files generated by the application. An attacker with low privileges can input specially crafted values that begin with characters interpreted as formulas by spreadsheet applications. When a victim downloads and opens the generated file in a compatible client, the content may be interpreted as a formula, potentially leading to unauthorised actions such as the execution of commands via mechanisms such as DDE, access to information, or interaction with system resources under the victim’s context.

• CWE-1236

• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-coupas-total-spend-management-platform

Published

Nov 4, 2026

Last Modified

Nov 4, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-111027The Welcart e-Commerce WordPress plugin before 2.12.6 does n…6.8
• CVE-2026-11103Inappropriate implementation in Installer in Google Chrome o…7.8
• CVE-2026-111031The Welcart e-Commerce WordPress plugin before 2.12.6 does n…4.7
• CVE-2026-111032The Welcart e-Commerce WordPress plugin before 2.12.6 does n…3.8
• CVE-2026-111036Server-side request forgery (SSRF) vulnerability in the Coup…8.4
• CVE-2026-111037A reflected Cross-Site Scripting (XSS) vulnerability in the …5.1
• CVE-2026-11104Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7…6.5
• CVE-2026-111040The platform allows persistent HTML injection into editable …5.1
• CVE-2026-111041The AI Engine WordPress plugin before 3.7.9 does not verify…4.9
• CVE-2026-111044Sunshine is a self-hosted game stream host for Moonlight. Fr…7.6
• CVE-2026-111045CLI Bridge provides filesystem access within a workspace roo…7.5
• CVE-2026-111046FOSSBilling is an open source billing and client-management …2.3