A CSV file injection vulnerability in BaserCMS poses a high risk to users by potentially allowing malicious formula execution upon opening exported data files.

This vulnerability is classified as CWE-1236, where the application fails to properly neutralize special characters in CSV output. The attack vector is network-based and requires user interaction, but does not require prior authentication.

The exploitation of this vulnerability could lead to unauthorized code execution on the local machines of users who open exported CSV files. With a CVSS score of 7.1, this flaw is considered high severity, as it can be used to facilitate phishing or data exfiltration via malicious spreadsheet formulas.

Immediate Action: Upgrade to BaserCMS version 5.3.0 or later as soon as the vendor patch is deployed.

Proactive Monitoring: Review web application logs for unusual patterns in data export requests that might indicate attempts to inject formula characters.

Compensating Controls: Implement strict input validation or sanitization routines for any user-supplied data that is subsequently included in exported CSV reports.

Public Exploit Available: No

Given the high CVSS score, organizations utilizing BaserCMS for reporting must treat this as a priority. Administrators should ensure that all instances are updated to version 5.3.0 immediately upon availability to eliminate the risk of formula injection.