CVE-2023-48709 is a high severity (CVSS 8.0) formula injection flaw in Combodo iTop, the IT service management platform. Data typed by users can end up as live formulas in CSV or Excel exports. It is fixed in iTop 2.7.9, 3.0.4, 3.1.1 and 3.2.0, so upgrade and train people who open exports.
What's affected
- Combodo iTop 2.7.8, 3.0.3 and 3.1.0 are the versions the GitHub advisory GHSA-9q3x-9987-53x9 lists as affected.
- Patched versions per the advisory: 2.7.9, 3.0.4, 3.1.1 and 3.2.0.
- The record's CPE data covers iTop generally, so treat earlier releases on those branches as suspect unless Combodo says otherwise.
- The advisory says the fix is an informative message shown to the user. It does not say the export content is rewritten, so the human warning is part of the defence.
- Severity: the record gives CVSS 8.0, which is high. KEV status: the record shows kev as false, and none of the sources we read report exploitation in the wild.
The CVSS 3.1 vector in the record is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. Read plainly, it describes an attack over the network, with low attack complexity, requiring low privileges and a user action such as opening a file or clicking a link. Impact on confidentiality is high, on integrity high and on availability high. The scope is unchanged, so the impact stays within the vulnerable component.
How to check if you're exposed
iTop is a PHP application you host yourself, so check the version shown in the application footer or in the About screen, and compare it with the patched list above.
Then ask who exports data. The risk sits with the person who opens a CSV or Excel export, not with the iTop server. Look at which teams export tickets, CIs or contacts, and which Excel configuration they use. The advisory notes that Excel 2016 does not block this class of problem by default.
If iTop was installed from an archive, your deployment records should show the release. If they do not, read the version from the running instance.
What to do now
- Upgrade to 2.7.9, 3.0.4, 3.1.1 or 3.2.0, whichever matches your current branch.
- Tell staff who export data to read any Excel warning about formulas or external content, and not to dismiss it.
- Follow Combodo's documentation to configure Excel so that formulas from untrusted files are not run automatically.
- Open exports in a viewer or text editor first when the data came from outside parties, such as portal users.
- Review who can enter free text through the portal, since that is where hostile cell content would start.
Why it matters
This is CWE-1236 (Improper Neutralization of Formula Elements in a CSV File), a form of CWE-74 (Injection). A spreadsheet cell that starts with certain characters is read as a formula, not text. If an application writes user supplied text into an export without neutralising those characters, the export carries the attacker's formula to whoever opens it.
The server is not compromised in this case. The target is the analyst or service desk worker who trusts a file that came from their own tool. That is why the advisory's workaround is about reading prompts and configuring Excel, and why user awareness is the real control here.
Quick check
Does this give an attacker access to the iTop server?
Not according to the advisory. The risk is to the machine of the person who opens the exported file in Excel.
Is the fix a code change that cleans cell content?
The advisory describes the patch as an informative message in the product. Check the release notes for your version for exact behaviour.
Sources
Last reviewed: 19 October 2026.
