CVE-2026-41073: RT: Spreadsheet downloads vulnerable to CSV/formula injection in Microsoft Excel and similar apps
Last updated 6 July 2026
Other sources
RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10 and 6.0.0 through 6.0.2 contain a spreadsheet (CSV/formula) injection vulnerability. User-controlled data in spreadsheet exports is not sanitized before being written to the output file, which can cause spreadsheet applications to interpret crafted values as formulas or macros when the file is opened. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by avoiding opening exported RT spreadsheet files directly in spreadsheet applications when the data may contain untrusted user input.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/request-tracker4to a version that resolves this vulnerability.Fixed in 4.4.6+dfsg-1.1+deb12u4 - Upgrade
Upgrade
debian/request-tracker5to a version that resolves this vulnerability.Fixed in 5.0.3+dfsg-3~deb12u6Fixed in 5.0.7+dfsg-4+deb13u3Fixed in 5.0.10+dfsg-3 - Upgrade
Upgrade
RT (open source issue/ticket tracking system)to a version that resolves this vulnerability.Fixed in 5.0.10 - Upgrade
Upgrade
RT (open source issue/ticket tracking system)to a version that resolves this vulnerability.Fixed in 6.0.3 - Compensating control
Temporarily work around by avoiding opening exported RT spreadsheet (CSV/formula) files directly in spreadsheet applications when the data may contain untrusted user input.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41073?
CVE-2026-41073 has a medium severity rating of 4.6.
How do I fix CVE-2026-41073?
To fix CVE-2026-41073, upgrade to Best Practical Request Tracker version 5.0.10, 6.0.3, or later.
What is the risk associated with CVE-2026-41073?
The risk associated with CVE-2026-41073 is categorized as a risk score of 30.
What type of vulnerability is CVE-2026-41073?
CVE-2026-41073 is a CSV/formula injection vulnerability affecting spreadsheet downloads.
Which versions are affected by CVE-2026-41073?
CVE-2026-41073 affects Best Practical Request Tracker versions prior to 5.0.10 and versions 6.0.0 through 6.0.2.