CVE-2023-46400 is a CSV formula injection flaw in the add guest function of KWHotel 0.47, scored critical (CVSS 9.8) in the record. Guest data is not validated and can carry spreadsheet formulas into an exported file. No fixed version is confirmed, so check with the vendor and treat exports as untrusted.
What's affected
The CVE record lists KWHotel 0.47. The public disclosure referenced by the record describes the KWHotel Free edition through version 0.47, and the add guest function, where a free text comment field is not validated and can be exported to a CSV file.
I could not confirm a fixed version from the sources available, and the vendor page was not part of the record. Check the KWHotel download page and release notes for a newer version, and ask the vendor directly.
How to check if you're exposed
Find out whether you run KWHotel 0.47 or earlier on any front desk or back office computer. The version is shown in the application's About window.
Then look at what you do with exported files. The problem appears when a CSV file with a malicious cell is opened in a spreadsheet program that treats text beginning with certain characters as a formula. If staff export guest lists and open them in Excel or a similar tool, the exposure exists. If exports are never opened that way, the practical risk is lower.
Search existing guest comment fields for entries that start with an equals sign, a plus sign, a minus sign or an at sign. Those are the characters spreadsheets treat as the start of a formula.
What to do now
- Check whether KWHotel 0.47 or older is installed anywhere.
- Ask the vendor for a fixed release and apply it when it is available.
- Until then, open exported CSV files in a plain text viewer, or in a spreadsheet with automatic formula handling and external links disabled.
- Review guest comment and invoice customer fields for entries that start with formula characters, and clean them.
- Train staff to treat unexpected prompts when opening an export as a stop sign.
Why it matters
CSV injection is tracked as CWE-1236, improper neutralisation of formula elements in a CSV file. The application stores text exactly as typed. When that text is written to a CSV file, spreadsheet software may read a cell that starts with a formula character as a formula and run it, instead of showing it as text. The harm happens on the computer of the person who opens the file, not on the server.
The score in the record is 9.8, which looks high for this class, since the usual path needs a person to open the file and accept prompts. The record's vector does not require user interaction, which is why the number is so large. Read the score as a prompt to check the facts for your own use, not as a measure of how easy the attack is. The sibling issue CVE-2023-46401 covers the invoice function. Neither is on the CISA Known Exploited Vulnerabilities list.
Quick check
Does this need a server compromise?
No. The data is typed into the application, and the harm happens when the exported file is opened in a spreadsheet.
Is there a fixed version?
I could not confirm one. Check the vendor and its release notes.
Sources
Last reviewed: 19 October 2026.
