> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://zuora.ferndocs.com/docs/platform/security-and-identity/administrator-settings/managing-your-tenant-profile/configure-csv-injection-protection-for-attachments/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://zuora.ferndocs.com/_mcp/server.

# Configure CSV injection protection for attachments

> Zuora provides options to manage CSV injection protection for attachments, allowing administrators to choose between allowing, blocking, or sanitizing potentially harmful spreadsheet formulas.

Zuora provides options to manage CSV injection protection for attachments, allowing administrators to choose between allowing, blocking, or sanitizing potentially harmful spreadsheet formulas.

Zuora allows administrators to control whether attachments containing potential CSV or spreadsheet formula injections are allowed, blocked, or sanitized. This setting helps protect users from malicious formulas that may run when files are opened in applications such as Microsoft Excel or LibreOffice Calc.

Navigate to **Settings** > **Administration** > **Manage Entity Profile**.

In the **Attachment Limits** section, click **Edit**.

Locate the CSV injection setting and select one of the following options:

1. **Allow**: Users can upload CSV or spreadsheet files without CSV injection validation. This preserves the previous behavior and may allow files that contain formulas starting with characters such as =, +, -, or @.
2. **Block**: Zuora checks uploaded CSV or spreadsheet files for formula patterns that may pose a security risk. If a risk is detected, the upload is blocked and the file is not attached.
3. **Sanitize**: Zuora automatically neutralizes potentially risky formulas in the uploaded CSV or spreadsheet file. Leading formula characters, such as =, +, -, or @, are removed or encoded so that affected cells are treated as plain text when opened, while the upload itself is allowed.

Click **Save**.

The selected CSV injection protection behavior is applied to file attachments for the entity.

> Zuora provides options to manage CSV injection protection for attachments, allowing administrators to choose between allowing, blocking, or sanitizing potentially harmful spreadsheet formulas.

## Docs

- [Default behavior for CSV injection protection](https://zuora.ferndocs.com/docs/platform/security-and-identity/administrator-settings/managing-your-tenant-profile/configure-csv-injection-protection-for-attachments/default-behavior-for-csv-injection-protection.md): The default CSV injection setting is Allow for existing tenants and entities, and Block for new ones, enhancing protection against CSV injection attacks.
- [Behavior when a risky file is uploaded](https://zuora.ferndocs.com/docs/platform/security-and-identity/administrator-settings/managing-your-tenant-profile/configure-csv-injection-protection-for-attachments/behavior-when-a-risky-file-is-uploaded.md): Describes the blocking of file uploads containing risky formulas to prevent security risks in CSV files.