CVE-2026-124591

CVSS 5.5 (medium) · published 2026-11-09

A vulnerability was detected in Bahleel 0.1.0/0.1.1. Affected is the function fputcsv of the file app/Exporters/CsvExporter.php. The manipulation results in csv injection. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.

Weakness: CWE-74, CWE-1236

Source: NVD CVE-2026-124591

References

• https://github.com/bahleel/bahleel/
• https://github.com/bahleel/bahleel/issues/1
• https://vuldb.com/cve/CVE-2026-124591
• https://vuldb.com/submit/1040551
• https://vuldb.com/vuln/433015
• https://vuldb.com/vuln/433015/cti

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.