CVE-2023-46401 is a CSV formula injection flaw in the invoice adding function of KWHotel 0.47, scored critical (CVSS 9.8) in the record. A field is not validated and can carry spreadsheet formulas into an export. No fixed version is confirmed, so contact the vendor and handle exports with care.
What's affected
The CVE record lists KWHotel 0.47. The public disclosure it references says the KWHotel Free edition through 0.47 is affected in the add invoice function, where the customer search field in the Accounting tab is not validated.
This is the second of two KWHotel records from the same disclosure. The first, CVE-2023-46400, covers the add guest function. If you run the product, assume both apply. I could not confirm a fixed version, so check the vendor site for a newer release.
How to check if you're exposed
Confirm whether KWHotel 0.47 or older is installed, using the About window of the application.
Then review how accounting data leaves the system. Invoices and customer lists are often exported for accountants, who open them in spreadsheets. That makes the invoice export the path where this flaw can matter.
To find existing risk, review exported accounting files and the underlying records for cells that begin with an equals sign, a plus sign, a minus sign or an at sign. Genuine customer names and invoice references rarely begin with those characters.
What to do now
- Find KWHotel installs and read their versions.
- Contact the vendor about a fixed release, and update when one exists.
- Open accounting exports in a tool that shows text without evaluating formulas, or disable automatic formula and external link handling in your spreadsheet software.
- Clean any records that start with formula characters.
- Share the warning with the person who receives your exports, such as an external accountant.
Why it matters
The class is CWE-1236, improper neutralisation of formula elements in a CSV file. The application accepts text without checking it and later writes that text to a file that another program interprets. The trust boundary sits between the export and the spreadsheet, and nothing in between removes the formula meaning of the first character.
The 9.8 score in the record comes from a vector with no required privileges and no user interaction, which overstates the real difficulty because a person has to open the file. Even so, finance and front desk staff open exports all the time, so the habit of opening CSV files without a second thought is the real exposure. The CVE is not on the CISA Known Exploited Vulnerabilities list.
A safe export routine prefixes risky cells with a harmless character so they display as text. If you build software that writes CSV files, add that step to your own code.
Quick check
How is this different from CVE-2023-46400?
It is the same weakness in a different place. This one is in the invoice function and the other is in the add guest function.
What is the safest way to open an export?
Use a text viewer, or a spreadsheet with automatic formula and external link handling turned off.
Sources
Last reviewed: 19 October 2026.
