CVE-2026-64955

MediumCVSS 6.1/10Last modified Oct 24, 2026

Description

When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution.

Velociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data exports.

It is not clear if the vulnerability is actually in Microsoft Excel treating a CSV data file as executable content, or if Velociraptor should be sanitizing the data to prevent Excel from executing it. However, since this is such a common use case for Velociraptor we decided to highlight it in an advisory.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-1236

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Aug 12, 2026
Last modified: Oct 24, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-649587.5An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a messag CVE-2026-649599.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerabi CVE-2026-64965.4A vulnerability was found in prasathmani TinyFileManager up to 2.6. Affected is an unknown function of the file /filemanager.php of the comp CVE-2026-649608.7ATutor Gameme module allows users to upload files of any type and extension without restriction. Due to improper handling of file uploads, f CVE-2026-649616.3ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values req CVE-2026-649625.1ATutor is vulnerable to Cross-Site Request Forgery (CSRF) in profile update functionality. An attacker can craft a malicious website which, CVE-2026-649632.3A path traversal vulnerability in ATutor allows an authenticated user to access files from other course directories when the AT_FORCE_GET_FI CVE-2026-649646.3ATutor generates predictable email confirmation tokens due to the use of insufficiently random values in the account confirmation functional CVE-2026-649655.3ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints. A low-privileged authenticated user (e.g. a stud CVE-2026-649668.7ATutor is vulnerable to a Path Traversal vulnerability in ZIP extraction functionality. An attacker with instructor privileges can upload an CVE-2026-649676.9A path traversal vulnerability in ATutor's error log viewer allows an attacker with administrative privileges to access arbitrary files outs CVE-2026-649685.1ATutor is vulnerable to Server-Side request forgery in import functionalities. An authenticated administrator can make the server request ar