Request Tracker CVE-2026-41073
MEDIUMSeverity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10 and 6.0.0 through 6.0.2 contain a spreadsheet (CSV/formula) injection vulnerability. User-controlled data in spreadsheet exports is not sanitized before being written to the output file, which can cause spreadsheet applications to interpret crafted values as formulas or macros when the file is opened. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by avoiding opening exported RT spreadsheet files directly in spreadsheet applications when the data may contain untrusted user input.
AnalysisAI
Spreadsheet formula injection in Best Practical Request Tracker (RT) allows a low-privileged authenticated attacker to embed malicious formulas in ticket fields that execute when an administrator or staff member exports data to CSV and opens the file in a spreadsheet application. Affected versions span the entire RT 5.0 line prior to 5.0.10 and RT 6.0.0 through 6.0.2. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the attack surface is broad given that CSV exports are a routine administrative workflow in ticketing systems.
Technical ContextAI
RT (Request Tracker) by Best Practical Solutions is an open-source enterprise ticketing platform. The affected component is its spreadsheet export feature, which serializes ticket data - including user-controlled fields such as subject lines, comments, and custom fields - into CSV or Excel-compatible output without sanitizing values that begin with formula-triggering characters (=, +, -, @, TAB, CR). CWE-1236 (Improper Neutralization of Formula Elements in a CSV File) describes exactly this root cause: the application treats user input as raw data but spreadsheet parsers like Microsoft Excel and LibreOffice Calc evaluate leading formula characters as executable instructions upon file open. The CPE cpe:2.3:a:bestpractical:rt:*:*:*:*:*:*:*:* covers all RT versions; the vendor-confirmed affected range is RT < 5.0.10 and RT 6.0.0 through 6.0.2.
RemediationAI
Upgrade to RT 5.0.10 (released 2026-05-20, SHA-256: 508b8d401273da4fe1c47e642ecb6017939ef560e9cfdfeb8d18ef41e4dbc5e6, available at https://download.bestpractical.com/pub/rt/release/rt-5.0.10.tar.gz) or RT 6.0.3 (tagged at https://github.com/bestpractical/rt/releases/tag/rt-6.0.3). The vendor notes this release also addresses higher-severity issues (CVE-2026-44231, CVE-2026-41075) making prompt upgrade strongly advisable. If immediate upgrade is not feasible, the vendor-recommended workaround is to avoid opening RT-exported CSV/spreadsheet files directly in desktop spreadsheet applications such as Excel or LibreOffice Calc when the underlying ticket data may contain untrusted user input. A practical compensating control is to import exports into a spreadsheet with formula evaluation disabled (e.g., Excel's 'Data > From Text/CSV' import with 'Disable formula evaluation' policy enforced via Group Policy) rather than double-clicking the file - this eliminates execution risk without disrupting the reporting workflow. Restricting RT account creation to vetted internal users reduces the attacker's ability to inject malicious content.
Privilege escalation and information disclosure in Best Practical's Request Tracker (RT) 6.0.0-6.0.2 and versions before
Authenticated SQL injection in Best Practical's Request Tracker (RT) ticketing system affects versions 5.0.0-5.0.9 and 6
Authentication bypass in Best Practical's Request Tracker (RT) versions 5.0.9 and prior, and 6.0.0 through 6.0.2, allows
Cross-site request forgery in Best Practical Request Tracker (RT) versions 6.0.0 through 6.0.2 allows remote attackers t
Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 does not properly restrict access to private callback c
Cross-site request forgery (CSRF) vulnerability in Request Tracker (RT) 3.8.12 and other versions before 3.8.15, and 4.0
Reflected Cross-Site Scripting in Best Practical RT versions 5.0.4-5.0.9 and 6.0.0-6.0.2 allows an unauthenticated attac
Reflected Cross-Site Scripting in RT (Request Tracker) 6.0.0 through 6.0.2 allows an unauthenticated network attacker to
Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote authenticated users with the permissions
Request Tracker (RT) 4.x before 4.0.13 does not properly enforce the DeleteTicket and "custom lifecycle transition" perm
Stored XSS in Best Practical RT (versions 5.0.0-5.0.9 and 6.0.0-6.0.2) allows any authenticated user with file upload pe
Stored Cross-Site Scripting in Best Practical RT versions 6.0.0 through 6.0.2 allows an authenticated attacker with writ
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today