Vulnerability Description
hustoj is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. All versions are vulnerable to CSV Injection (Formula Injection) through the contest rank export functionality (contestrank.xls.php and admin/ranklist_export.php). The application fails to sanitize user-supplied input (specifically the "Nickname" field) before exporting it to an .xls file (which renders as an HTML table but is opened by Excel). If a malicious user sets their nickname to an Excel formula when an administrator exports and opens the rank list in Microsoft Excel, the formula will be executed. This can lead to arbitrary command execution (RCE) on the administrator's machine or data exfiltration. A fix was not available at the time of publication.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Hustoj | Hustoj | <= 26.01.31 |
Related Weaknesses (CWE)
References
- https://github.com/zhblue/hustoj/security/advisories/GHSA-gqwv-v7vx-2qjwExploitMitigationVendor Advisory
FAQ
What is CVE-2026-23873?
CVE-2026-23873 is a vulnerability with a CVSS score of 9.0 (CRITICAL). hustoj is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. All versions are vulnerable to CSV Injection (Formula Injection) through the contest rank export func...
How severe is CVE-2026-23873?
CVE-2026-23873 has been rated CRITICAL with a CVSS base score of 9.0/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-23873?
Check the references section above for vendor advisories and patch information. Affected products include: Hustoj Hustoj.