CVE-2026-93581: Insufficient Neutralization of Formula Elements in CSV Exports
User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authenticated users or received through external communication channels such as email, may be stored in fields that are later included in CSV exports. An attacker can therefore inject values beginning with spreadsheet formula characters such as =, +, -, or @. An attacker does not necessarily require an authenticated account if the affected field can be populated through an external input channel such as incoming email.
When an affected CSV file is opened in spreadsheet software, the application may interpret these values as formulas instead of plain text. Depending on the spreadsheet application and its security configuration, a malicious formula may cause unintended actions, disclose information, or invoke external functionality. Exploitation may require the user opening the exported CSV file to confirm one or more security warning dialogs. The vulnerability does not execute code on the OTRS server; any additional impact occurs in the spreadsheet application used to process the exported file.
This issue affects OTRS:
7.0.X 8.0.X 2023.X 2024.X 2025.X 2026.X before 2026.7.X
Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OTRSto a version that resolves this vulnerability.Fixed in 2026.7.1
Event History
Frequently Asked Questions
Who can inject values that reach an affected CSV export?
Any user who can populate a field later included in a CSV export may be able to inject a formula value. This can include authenticated users and, where the field accepts external input, unauthenticated parties sending data through channels such as incoming email.
What must happen for exploitation to have an effect?
A user must export the affected data and open the resulting CSV file in spreadsheet software. The spreadsheet application must interpret the injected value as a formula, and the user may need to confirm one or more security warnings.
Is the OTRS server itself subject to code execution?
No. The described issue does not execute code on the OTRS server; any further impact occurs in the spreadsheet application used to open the CSV file.
What factors limit the impact of a malicious formula?
The outcome depends on the spreadsheet application and its security configuration. A formula may cause unintended actions, disclose information, or invoke external functionality, but security warnings may need to be accepted.