I'm allowing users to upload CSV files. Other users can download these files. I'm aware that CSV could be an attack vector.

Would a ClamAV (or other AV) scan offer protection against such a file?

Any scan would happen only after validating the MIME type.


ClamAV has, as far as I know, no specific detection features for CSV files. CSV injection is not a vulnerability that an AV would resolve directly. Instead, an AV may detect known malicious macro payloads that were injected into a file, regardless of the file type.

If you want to know about specific detection features, I suggest talking to the ClamAV maintainers. For now, I recommend following OWASP's advice on filtering: do not allow any cell to start with -, +, =, or @.

  • 2
    I found you need to bypass the following characters: '=', '+', '-', '@', '|', '%'. Otherwise your filter can be bypassed. See: hackerone.com/reports/223999
    – Refineo
    Mar 12 '19 at 19:58
  • @Refineo Good to know.
    – Polynomial
    Mar 12 '19 at 23:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.