{"id":"CVE-2026-41073","aliases":["DEBIAN-CVE-2026-41073","EUVD-2026-31500","GHSA-6x92-7v65-7m3r","UBUNTU-CVE-2026-41073","USN-8506-1"],"status":"published","title":"RT: Spreadsheet downloads vulnerable to CSV/formula injection in Microsoft Excel and similar apps","description":"RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10 and 6.0.0 through 6.0.2 contain a spreadsheet (CSV/formula) injection vulnerability. User-controlled data in spreadsheet exports is not sanitized before being written to the output file, which can cause spreadsheet applications to interpret crafted values as formulas or macros when the file is opened. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by avoiding opening exported RT spreadsheet files directly in spreadsheet applications when the data may contain untrusted user input.","severity":{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00166,"percentile":0.05876,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1236"],"published":"2026-05-22T21:10:22Z","modified":"2026-10-28T02:31:11Z","fixes":[{"ecosystem":"Debian:12","package":"request-tracker4","fixed_in":["4.4.6+dfsg-1.1+deb12u4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"request-tracker5","fixed_in":["5.0.3+dfsg-3~deb12u6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"request-tracker5","fixed_in":["5.0.7+dfsg-4+deb13u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"request-tracker5","fixed_in":["5.0.10+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"request-tracker5","fixed_in":["5.0.1+dfsg-1ubuntu1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"request-tracker5","fixed_in":["5.0.5+dfsg-2ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:26.04:LTS","package":"request-tracker5","fixed_in":["5.0.7+dfsg-6ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"request-tracker4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.6+dfsg-1.1+deb12u4"}]}],"versions":["4.4.6+dfsg-1.1","4.4.6+dfsg-1.1+deb12u1","4.4.6+dfsg-1.1+deb12u2","4.4.6+dfsg-1.1+deb12u3"]},{"source":"osv","ecosystem":"Debian:12","package":"request-tracker5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.3+dfsg-3~deb12u6"}]}],"versions":["5.0.3+dfsg-2","5.0.3+dfsg-3~deb12u1","5.0.3+dfsg-3~deb12u2","5.0.3+dfsg-3~deb12u3","5.0.3+dfsg-3~deb12u4","5.0.3+dfsg-3~deb12u5"]},{"source":"osv","ecosystem":"Debian:13","package":"request-tracker5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.7+dfsg-4+deb13u3"}]}],"versions":["5.0.7+dfsg-4","5.0.7+dfsg-4+deb13u1","5.0.7+dfsg-4+deb13u2"]},{"source":"osv","ecosystem":"Debian:14","package":"request-tracker5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.10+dfsg-1"}]}],"versions":["5.0.7+dfsg-4","5.0.7+dfsg-5","5.0.7+dfsg-6","5.0.9+dfsg-1","5.0.9+dfsg-2","5.0.9+dfsg-3","5.0.9+dfsg-4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"request-tracker4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.11-2","4.2.12-3","4.2.12-4","4.2.12-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"request-tracker4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.1-5","4.4.2-1","4.4.2-2","4.4.2-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"request-tracker4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.3-2","4.4.3-2+deb10u3build0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"request-tracker4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.4+dfsg-2ubuntu1","4.4.4+dfsg-2ubuntu1.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"request-tracker5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1+dfsg-1ubuntu1+esm2"}]}],"versions":["5.0.1+dfsg-1ubuntu1","5.0.1+dfsg-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"request-tracker4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.4+dfsg-2ubuntu1","4.4.4+dfsg-2ubuntu2","4.4.7+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"request-tracker5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5+dfsg-2ubuntu0.1~esm2"}]}],"versions":["5.0.1+dfsg-1ubuntu1","5.0.5+dfsg-2","5.0.5+dfsg-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"request-tracker4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.7+dfsg-4syncable1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"request-tracker5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.7+dfsg-2","5.0.7+dfsg-3","5.0.7+dfsg-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"request-tracker4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.7+dfsg-4syncable1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"request-tracker5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.7+dfsg-6ubuntu0.1~esm1"}]}],"versions":["5.0.7+dfsg-4","5.0.7+dfsg-6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"request-tracker5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1+dfsg-1ubuntu1+esm2"}]}],"versions":["5.0.1+dfsg-1ubuntu1","5.0.1+dfsg-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"request-tracker5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5+dfsg-2ubuntu0.1~esm2"}]}],"versions":["5.0.1+dfsg-1ubuntu1","5.0.5+dfsg-2","5.0.5+dfsg-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"request-tracker5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.7+dfsg-6ubuntu0.1~esm1"}]}],"versions":["5.0.7+dfsg-4","5.0.7+dfsg-6"]}],"products":[{"vendor":"bestpractical","product":"rt"}],"references":[{"url":"https://github.com/bestpractical/rt/security/advisories/GHSA-6x92-7v65-7m3r","tags":["x_refsource_CONFIRM","advisory"]},{"url":"https://github.com/bestpractical/rt/releases/tag/rt-5.0.10","tags":["x_refsource_MISC","web","report"]},{"url":"https://github.com/bestpractical/rt/releases/tag/rt-6.0.3","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41073.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41073","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-41073","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-41073","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41073","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8506-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-6841","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-41075","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-41076","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-44229","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-44230","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-44231","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-41073","title":"RT: Spreadsheet downloads vulnerable to CSV/formula injection in Microsoft Excel and similar apps","description":"RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10 and 6.0.0 through 6.0.2 contain a spreadsheet (CSV/formula) injection vulnerability. User-controlled data in spreadsheet exports is not sanitized before being written to the output file, which can cause spreadsheet applications to interpret crafted values as formulas or macros when the file is opened. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by avoiding opening exported RT spreadsheet files directly in spreadsheet applications when the data may contain untrusted user input.","status":"published","published":"2026-05-22T21:10:22.249Z","modified":"2026-05-23T02:57:38.966Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-1236"],"updated_at":"2026-11-02T13:41:08.498858Z"}],"euvd":[{"id":"EUVD-2026-31500","description":"RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10 and 6.0.0 through 6.0.2 contain a spreadsheet (CSV/formula) injection vulnerability. User-controlled data in spreadsheet exports is not sanitized before being written to the output file, which can cause spreadsheet applications to interpret crafted values as formulas or macros when the file is opened. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by avoiding opening exported RT spreadsheet files directly in spreadsheet applications when the data may contain untrusted user input.","status":"published","published":"2026-05-22T21:10:22Z","modified":"2026-05-23T02:57:38Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:21:12.112235Z"}],"nvd":[{"id":"CVE-2026-41073","description":"RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10 and 6.0.0 through 6.0.2 contain a spreadsheet (CSV/formula) injection vulnerability. User-controlled data in spreadsheet exports is not sanitized before being written to the output file, which can cause spreadsheet applications to interpret crafted values as formulas or macros when the file is opened. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by avoiding opening exported RT spreadsheet files directly in spreadsheet applications when the data may contain untrusted user input.","status":"published","published":"2026-05-22T22:16:55.65Z","modified":"2026-07-23T11:10:00.12Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-1236"],"updated_at":"2026-11-02T14:12:20.131508Z"}],"osv":[{"id":"CVE-2026-41073","title":"RT: Spreadsheet downloads vulnerable to CSV/formula injection in Microsoft Excel and similar apps","description":"RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10 and 6.0.0 through 6.0.2 contain a spreadsheet (CSV/formula) injection vulnerability. User-controlled data in spreadsheet exports is not sanitized before being written to the output file, which can cause spreadsheet applications to interpret crafted values as formulas or macros when the file is opened. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by avoiding opening exported RT spreadsheet files directly in spreadsheet applications when the data may contain untrusted user input.","status":"published","published":"2026-05-22T21:10:22.249Z","modified":"2026-10-28T02:31:11.104218173Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-1236"],"updated_at":"2026-11-02T15:45:03.424067Z"},{"id":"DEBIAN-CVE-2026-41073","description":"RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10 and 6.0.0 through 6.0.2 contain a spreadsheet (CSV/formula) injection vulnerability. User-controlled data in spreadsheet exports is not sanitized before being written to the output file, which can cause spreadsheet applications to interpret crafted values as formulas or macros when the file is opened. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by avoiding opening exported RT spreadsheet files directly in spreadsheet applications when the data may contain untrusted user input.","status":"published","published":"2026-05-22T22:16:55.65Z","modified":"2026-10-01T03:03:22.837885593Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"UBUNTU-CVE-2026-41073","description":"RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10 and 6.0.0 through 6.0.2 contain a spreadsheet (CSV/formula) injection vulnerability. User-controlled data in spreadsheet exports is not sanitized before being written to the output file, which can cause spreadsheet applications to interpret crafted values as formulas or macros when the file is opened. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by avoiding opening exported RT spreadsheet files directly in spreadsheet applications when the data may contain untrusted user input.","status":"published","published":"2026-05-22T22:16:00Z","modified":"2026-07-06T20:31:01.939082973Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:16.686388Z"},{"id":"USN-8506-1","title":"request-tracker5 vulnerabilities","description":"Aleksander Iwicki discovered that Request Tracker did not properly sanitize\nthe search \"Page\" URL parameter. A remote attacker could possibly use this\nissue to conduct a reflected cross-site scripting attack. (CVE-2026-6841)\n\nIt was discovered that Request Tracker did not properly sanitize user-\ncontrolled data written to spreadsheet exports of search results. A remote\nattacker could possibly use this issue to conduct a spreadsheet\n(CSV/formula) injection attack, causing spreadsheet applications to\ninterpret crafted values as formulas or macros when the file is opened.\n(CVE-2026-41073)\n\nIt was discovered that Request Tracker did not properly validate input\nincorporated into database queries via the entry_aggregator parameter in\nJSON search. An authenticated user could possibly use this issue to perform\nSQL injection attacks and read or modify data in the RT database.\n(CVE-2026-41075)\n\nIt was discovered that Request Tracker contained an authentication bypass\nwhen configured to authenticate users against an LDAP or Active Directory\nserver. Under certain LDAP server configurations, a remote attacker could\npossibly use this issue to authenticate as any LDAP-backed RT user without\nsupplying valid credentials. (CVE-2026-41076)\n\nIt was discovered that Request Tracker served certain uploaded content\ninline rather than as an attachment. A remote attacker could possibly use\nthis issue to conduct a cross-site scripting attack. (CVE-2026-44229)\n\nIt was discovered that Request Tracker did not properly sanitize input on\nsearch-results chart pages. A remote attacker could possibly use this issue\nto conduct a reflected cross-site scripting attack. (CVE-2026-44230)\n\nJeroen Gui discovered that Request Tracker did not properly restrict access\nto the REST 2.0 user collection endpoint. A privileged user could possibly\nuse this issue to obtain authentication credentials belonging to other\nusers, including administrators, resulting in privilege escalation and\ninformation disclosure. (CVE-2026-44231)","status":"published","published":"2026-07-06T11:15:39Z","modified":"2026-07-24T15:34:30.613613415Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}