A CSV injection vulnerability in Dirsearch 0.4.1 allows attackers to manipulate generated reports, posing a risk to users who process these files in spreadsheet applications.

This is a CWE-1236 Improper Neutralization of Formula Elements vulnerability. An unauthenticated attacker can craft malicious redirects that, when included in a CSV report, execute arbitrary formulas upon opening the file.

While the technical impact is limited to the client-side manipulation of CSV files, the potential for data exfiltration or unauthorized system interaction via spreadsheet macros is high if the reports are processed by administrative staff. The CVSS score reflects this risk to data integrity within the organization's reporting workflow.

Immediate Action: Upgrade to the latest version of dirsearch available from the official repository, as the vendor has addressed this class of vulnerability in subsequent releases.

Proactive Monitoring: Review generated CSV reports for unexpected character sequences (e.g., =, +, -, @) in fields that should contain standard text.

Compensating Controls: Configure spreadsheet software (like Microsoft Excel or LibreOffice) to disable automatic macro execution and display warnings for untrusted external data sources.

Public Exploit Available: Yes — an entry exists on ExploitDB (49370).

Users of dirsearch version 0.4.1 should update immediately to mitigate the risk of CSV injection. Security teams should ensure that automated reporting workflows are hardened against malicious formula injection by validating input data before report generation.