CVE-2025-22978

CVE-2025-22978 is a CSV Injection vulnerability affecting eladmin versions 2.7 and earlier, specifically in the exception log download module. Published on 2025-02-03, this issue falls under CWE-74 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impacts across confidentiality, integrity, and availability.

Unauthenticated remote attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required. Exploitation allows adversaries to inject malicious payloads into the CSV output, potentially leading to high-level compromise of systems that process the downloaded logs.

Mitigation is provided through a patch in the commit at https://github.com/elunez/eladmin/commit/d6a16e9afc0a3b96a56f1a24ed167e1beec6ce2f. Additional details on the vulnerability are documented in the GitHub issue at https://github.com/elunez/eladmin/issues/863.