CVE-2026-41073: RT Ticket System CSV Injection Flaw

CVE-2026-41073 Overview

CVE-2026-41073 is a spreadsheet formula injection vulnerability in Request Tracker (RT), an open source enterprise ticket tracking system from Best Practical. The flaw affects RT versions prior to 5.0.10 and versions 6.0.0 through 6.0.2. User-controlled data exported to spreadsheet files is written without sanitization. When a user opens the exported file, a spreadsheet application can interpret crafted values as formulas or macros. This issue is tracked under [CWE-1236: Improper Neutralization of Formula Elements in a CSV File].

Critical Impact
Attackers with low-privileged RT access can inject formulas into exported CSV files. Downstream users opening the file in a spreadsheet application may execute attacker-controlled formulas or macros.

Affected Products

Best Practical Request Tracker (RT) versions prior to 5.0.10
Best Practical Request Tracker (RT) versions 6.0.0 through 6.0.2
RT spreadsheet (CSV) export functionality

Discovery Timeline

2026-05-22 - CVE-2026-41073 published to the National Vulnerability Database (NVD)
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-41073

Vulnerability Analysis

The vulnerability stems from RT writing user-supplied content directly into CSV exports without neutralizing leading characters that spreadsheet applications interpret as formula triggers. Characters such as =, +, -, @, and tab/carriage-return prefixes cause applications like Microsoft Excel, LibreOffice Calc, and Google Sheets to evaluate the cell as a formula rather than literal text.

An attacker submits ticket field values containing crafted formula payloads. When an RT administrator or analyst exports tickets to CSV and opens the file, the spreadsheet engine evaluates the payload. This can trigger external data retrieval through functions such as WEBSERVICE or HYPERLINK, invoke DDE command execution in vulnerable configurations, or coerce users into clicking malicious hyperlinks. Exploitation requires user interaction, which is reflected in the attack model.

Root Cause

The root cause is missing output encoding in RT's spreadsheet export routines. The export logic concatenates raw ticket data into CSV rows without prefixing dangerous leading characters with a single quote or stripping formula triggers. CWE-1236 specifically covers this class of injection.

Attack Vector

The attack vector is network-based and requires low privileges and user interaction. An authenticated low-privileged user (for example, an external requestor with permission to create tickets or comments) submits content containing a formula payload. A second user with export permissions later generates a CSV and opens it, triggering formula execution in the spreadsheet client.

No verified public exploit code is available. Technical details are documented in the GitHub Security Advisory GHSA-6x92-7v65-7m3r.

Detection Methods for CVE-2026-41073

Indicators of Compromise

Ticket fields, subjects, or comments containing leading characters =, +, -, @, tab, or carriage return followed by spreadsheet function names such as WEBSERVICE, HYPERLINK, IMPORTXML, or DDE
Outbound HTTP/DNS requests originating from excel.exe, soffice.bin, or browser processes shortly after a user opens an RT CSV export
Unexpected child processes spawned by spreadsheet applications following CSV file opens

Detection Strategies

Scan RT database content and exported CSV artifacts for cells beginning with formula trigger characters using regular expressions such as ^[=+\-@\t\r]
Inspect web server logs for ticket submission requests where field values begin with formula trigger characters
Correlate endpoint telemetry of EXCEL.EXE or soffice.bin opening files from RT export directories with subsequent network connections to unknown domains

Monitoring Recommendations

Monitor RT export endpoints (/Search/Results.tsv, /Search/Results.xlsx, and equivalent CSV routes) for high-volume export activity by single users
Alert on spreadsheet processes invoking cmd.exe, powershell.exe, or making outbound web requests, which can indicate formula or DDE abuse
Track RT version inventory and flag instances running 5.0.x below 5.0.10 or 6.0.0 through 6.0.2

How to Mitigate CVE-2026-41073

Immediate Actions Required

Upgrade RT to version 5.0.10 or 6.0.3 as released by Best Practical
Audit existing CSV and TSV exports for cells beginning with =, +, -, @, tab, or carriage return characters
Restrict RT export permissions to trusted users until patching is complete
Communicate to staff that exported RT spreadsheets containing user-submitted data should not be opened directly in Excel or Calc

Patch Information

Best Practical has released fixed builds. Upgrade to RT 5.0.10 for the 5.0 branch or RT 6.0.3 for the 6.0 branch. Refer to the GitHub Security Advisory GHSA-6x92-7v65-7m3r for full advisory details.

Workarounds

Avoid opening exported RT spreadsheet files directly in spreadsheet applications when data may contain untrusted user input
Import CSV exports as plain text by using the spreadsheet application's data import wizard and selecting text format for all columns
Pre-process CSV exports through a sanitization script that prefixes any cell beginning with =, +, -, @, tab, or carriage return with a single quote
Configure Microsoft Excel and LibreOffice Calc to disable Dynamic Data Exchange (DDE) and external data retrieval features in managed environments

bash

# Configuration example: sanitize a CSV export before opening
# Prefixes any field starting with a formula trigger character with a single quote
awk 'BEGIN{FS=OFS=","} {for(i=1;i<=NF;i++){if($i ~ /^[=+\-@\t\r]/){$i="\\x27"$i}} print}' \
  rt-export.csv > rt-export-safe.csv