CVE-2026-41073

MediumCVSS 4.6

Published: 22/05/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

RT (Request Tracker) versions before 5.0.10 and 6.0.0 through 6.0.2 contain a spreadsheet (CSV/formula) injection vulnerability. User-controlled data in spreadsheet exports is not sanitized before being written to the output file, which can cause spreadsheet applications to interpret crafted values as formulas or macros when the file is opened.

Risk Assessment

An attacker can inject malicious formulas into exported data, which when opened in a spreadsheet application can execute unwanted actions, such as downloading malware or exfiltrating data.

Recommendation

Update RT to version 5.0.10 or 6.0.3. If an upgrade is not possible, avoid opening exported CSV files directly in spreadsheet applications until the data is verified.

Other vulnerabilities in RT (Request Tracker)

CVE-2026-44231Critical
Vulnerability in RT (Request Tracker) before versions 5.0.10 and 6.0.3 in the REST 2.0 API allows a privileged (non-admin) user to obtain credentials of other users, including admins, and use them to read data via feeds. The request rotates the credentials, invalidating existing feed URLs.

Original NVD description (English source)

RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10 and 6.0.0 through 6.0.2 contain a spreadsheet (CSV/formula) injection vulnerability. User-controlled data in spreadsheet exports is not sanitized before being written to the output file, which can cause spreadsheet applications to interpret crafted values as formulas or macros when the file is opened. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by avoiding opening exported RT spreadsheet files directly in spreadsheet applications when the data may contain untrusted user input.