← Vulnerability feed

Vulnerability record · CVE-2026-23873 · published 22 January 2026

CVE-2026-23873: Hustoj csv injection vulnerability

Hustoj · Hustoj

hustoj is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. All versions are vulnerable to CSV Injection (Formula Injection) through the contest rank export functionality (contestrank.xls.php and admin/ranklist_export.php). The application fails to sanitize user-supplied input (specifically the "Nickname" field) before exporting it to an .xls file (which renders as an HTML table but is opened by Excel). If a malicious user sets their nickname to an Excel formula when an administrator exports and opens the rank list in Microsoft Excel, the formula will be executed. This can lead to arbitrary command execution (RCE) on the administrator's machine or data exfiltration. A fix was not available at the time of publication.

5.2 CVSS 4.0 Medium EPSS 0.58% · top 54.6% CWE-1236 · CSV injection
5.2CVSS 4.0 base score
0.58%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

hustoj is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. All versions are vulnerable to CSV Injection (Formula Injection) through the contest rank export functionality (contestrank.xls.php and admin/ranklist_export.php). The application fails to sanitize user-supplied input (specifically the "Nickname" field) before exporting it to an .xls file (which renders as an HTML table but is opened by Excel). If a malicious user sets their nickname to an Excel formula when an administrator exports and opens the rank list in Microsoft Excel, the formula will be executed. This can lead to arbitrary command execution (RCE) on the administrator's machine or data exfiltration. A fix was not available at the time of publication.

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/zhblue/hustoj/security/advisories/GHSA-gqwv-v7vx-2qjw ExploitMitigationVendor Advisory

Track CVE-2026-23873 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.3CVE-2026-24479Hustoj path traversal vulnerabilityHUSTOF is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. Prior to version 26.01.24, the problem_import_qduo…EPSS 8.3%6.1CVE-2025-50938Hustoj cross-site scripting vulnerabilityCross site scripting (XSS) vulnerability in Hustoj 2025-01-31 via the TID parameter to thread.php.EPSS 0.24%6.1CVE-2022-42187Hustoj cross-site scripting vulnerabilityHustoj 22.09.22 has a XSS Vulnerability in /admin/problem_judge.php.EPSS 0.43%

Source: NIST National Vulnerability Database (record CVE-2026-23873), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.