dirsearch 0.4.1 - CSV Injection | Advisories

Advisories

dirsearch 0.4.1 - CSV Injection

severity: medium
date: January 27, 2026
Affecting: dirsearch 0.4.1
CVE: CVE-2021-47901
CWE: CWE-1236 Improper Neutralization of Formula Elements in a CSV File
CVSS: 5.1
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
References: ExploitDB-49370
dirsearch GitHub Repository
Credit: Dolev Farhi
Description: Dirsearch 0.4.1 contains a CSV injection vulnerability when using the --csv-report flag that allows attackers to inject formulas through redirected endpoints. Attackers can craft malicious server redirects with comma-separated paths containing Excel formulas to manipulate the generated CSV report.