CVE-2025-61873: Low severity Best Practical Solutions Request Tracker vulnerability
Published Jan 16, 2026
·Updated
Best Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used.
Affected Software
1 affected component
Best Practical Solutions Request Tracker<4.4.9, <5.0.9, <6.0.2
Event History
Jan 16, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-61873?
CVE-2025-61873 has a medium severity due to potential CSV injection risks.
2
How do I fix CVE-2025-61873?
To fix CVE-2025-61873, upgrade to Request Tracker versions 4.4.9, 5.0.9, or 6.0.2 or later.
3
What is the impact of CVE-2025-61873?
CVE-2025-61873 allows attackers to execute arbitrary commands if malicious CSV content is executed by users.
4
What versions are affected by CVE-2025-61873?
CVE-2025-61873 affects Best Practical Request Tracker versions prior to 4.4.9, 5.0.9, and 6.0.2.
5
Is CVE-2025-61873 related to ticket values?
Yes, CVE-2025-61873 enables CSV injection through user-provided ticket values during TSV export.