An authenticated CSV injection vulnerability in ProjectSend r1605 poses a significant risk as it allows malicious formulas to be executed when administrators export system logs.

This vulnerability is classified as CWE-1236, where improper neutralization of formula elements in CSV files allows an authenticated user to inject malicious payloads into the user profile name field. When an administrator exports these logs, the injected formulas can trigger unauthorized code execution on the administrator workstation.

The potential for unauthorized code execution on administrative endpoints presents a severe risk to organizational integrity. Given the CVSS score of 8.8, this vulnerability is considered high severity, as it facilitates lateral movement or endpoint compromise by leveraging the trust placed in exported system reports.

Immediate Action: Since a specific patch version is not currently identified, administrators should restrict user profile modification permissions and exercise extreme caution when opening CSV files exported from the application.

Proactive Monitoring: Review application access logs for unusual characters or formulaic patterns (such as =, @, +, or -) within the user profile name fields.

Compensating Controls: Implement endpoint security policies that disable automatic formula execution in spreadsheet software used to open exported application logs.

Public Exploit Available: Yes, a published proof-of-concept exists via the ExploitDB entry 51517.

Given the high CVSS score and the availability of a public exploit, organizations currently utilizing ProjectSend r1605 must prioritize the mitigation of this flaw. Administrators should treat all exported CSV files from the application as untrusted until the vendor provides a formal security update or a hardened configuration.