CVE-2026-35157 MEDIUM

CVE-2026-35157

Vendor Dell
Product ECS
Weakness CWE-1236
Published May 11, 2026
Last update May 12, 2026
View on NVD All CVEs

CVSS base score

5.8/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an improper neutralization of formula elements in a CSV File vulnerability in the UI. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution.

Key dates

02Disclosure timeline

May 11, 2026 CVE published
May 12, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2022-41675 TEAM JOHNLONG SOFTWARE CO., LTD. MAILD Mail Server - Formula Injection CVE-2023-37219 Tadiran Telecom Composit - CWE-1236: Improper Neutralization of Formula Elements in a CSV File CVE-2022-45357 WordPress 1003 Mortgage Application Plugin <= 1.75 is vulnerable to CSV Injection CVE-2025-7061 Intelbras InControl operador csv injection CVE-2025-11254 Contest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.3 - Unauthenticated CSV Injection