CVE-2026-47693: Poweradmin CSV Formula Injection Vulnerability

Technical summary

CVE-2026-47693 is a formula injection vulnerability (CWE-1236) in Poweradmin's CSV export functionality. The vulnerability exists because user-controlled input—specifically the username field—is written directly to CSV output without removing or escaping formula trigger characters (=, +, -, @). When the exported CSV is imported into a spreadsheet application, the formula trigger characters cause the spreadsheet processor to interpret the content as a formula rather than literal text, leading to arbitrary code execution in the context of the user's spreadsheet application. The CVSS 3.1 score of 6.9 (MEDIUM) reflects the requirement for high-privilege access (administrator account needed to export logs) and user interaction (opening the CSV in a spreadsheet), but acknowledges the potential for confidentiality impact and cross-system effects.

Business impact

For organizations operating PowerDNS infrastructure via Poweradmin, this vulnerability poses a targeted risk to administrative staff. An attacker who gains the ability to create user accounts or modify existing ones could inject malicious formulas into usernames. When administrators perform routine log exports and open those files, the attacker's formulas execute with the privileges of the administrator's user session. This could lead to credential theft via phishing-style attacks, lateral movement into the administrator's workstation, or exfiltration of sensitive DNS administration data. The attack requires premeditation and access to the Poweradmin interface to set up the payload, but impacts the security posture of administrators and the broader network they manage.

Affected systems

Poweradmin versions prior to 4.2.4 (in the 4.2.x line) and prior to 4.3.3 (in the 4.3.x line) are affected. Organizations should verify their installed version and update accordingly. The vulnerability does not affect the underlying PowerDNS server itself, only the Poweradmin administrative interface.

Exploitability

Exploitability is moderate. An attacker must first gain the ability to create or modify user accounts in Poweradmin—typically requiring compromise of an administrative account or an existing privilege escalation vulnerability. Once a malicious username is created, the attack is passive: it activates only when an administrator exports logs and opens the file in a spreadsheet application. The attack does not require zero-days or sophisticated techniques; standard formula injection payloads are sufficient. However, the requirement for prior administrative access and reliance on user interaction (opening the exported file) prevents this from being easily exploitable at scale. The vulnerability is not currently tracked on the KEV catalog.

Remediation

Apply patches immediately: upgrade to Poweradmin 4.2.4 or later for the 4.2.x branch, or 4.3.3 or later for the 4.3.x branch. These versions sanitize the username field during CSV export by removing or escaping formula trigger characters before writing to the file. As a temporary mitigation while patches are being staged, restrict CSV export functionality to trusted administrators and monitor user creation/modification events for suspicious entries that begin with formula trigger characters.

Patch guidance

Consult the Poweradmin project's official release notes for versions 4.2.4 and 4.3.3 to confirm patch contents and any compatibility notes. Apply patches during a maintenance window to avoid service disruption. After patching, test log export functionality to ensure CSV files open correctly and that formula characters in usernames (if any) are now safely escaped. Organizations managing multiple Poweradmin instances should prioritize environments that support critical DNS operations.

Detection guidance

Review access logs for Poweradmin to identify user creation or modification events, particularly those with usernames containing special characters (=, +, -, @). Examine any exported CSV files from recent log exports; if opened, check for unexpected formula execution or system behavior on administrator workstations. Monitor for suspicious spreadsheet activity on systems used by DNS administrators. Additionally, audit existing Poweradmin user accounts for suspicious naming patterns that match formula injection payloads.

Why prioritize this

Although assigned a MEDIUM CVSS score, this vulnerability merits near-term patching due to its targeting of administrative staff and the potential for post-exploitation lateral movement. Organizations with strict change-control processes may deprioritize this slightly, but those with frequent log exports or high-privilege DNS management should treat it as HIGH priority. The attack surface is limited to administrators, reducing organizational risk, but the impact to compromised administrators is significant.

Risk score, explained

The CVSS 3.1 score of 6.9 reflects: (1) Network attack vector—the vulnerability is reachable if Poweradmin is accessible over the network; (2) Low attack complexity—no special conditions or race conditions required; (3) High privilege requirement—the attacker must be authenticated and authorized to create users; (4) Required user interaction—the administrator must export logs and open the CSV; (5) Changed scope—code executes in the spreadsheet application, affecting systems beyond Poweradmin itself; (6) High confidentiality impact—the attacker can exfiltrate data via the formula; (7) Low integrity impact—formulas may alter displayed content but not the underlying DNS configuration; (8) No availability impact. The moderate score reflects the prerequisite of administrative compromise and the user-interaction requirement, balanced against the cross-system scope.

Frequently asked questions