What is the CVSS score of CVE-2026-41073?

CVE-2026-41073 has a CVSS 3.1 base score of 4.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-41073?

Yes, a patch is available for CVE-2026-41073. Update the affected software to the latest version immediately.

Request Tracker CVE-2026-41073

MEDIUM

Improper Neutralization of Formula Elements in a CSV File (CWE-1236)

2026-05-22 GitHub_M

Code Injection Rt

4.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.6 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

May 22, 2026 - 21:46 vuln.today

Analysis Generated

May 22, 2026 - 21:46 vuln.today

DescriptionGitHub Advisory

RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10 and 6.0.0 through 6.0.2 contain a spreadsheet (CSV/formula) injection vulnerability. User-controlled data in spreadsheet exports is not sanitized before being written to the output file, which can cause spreadsheet applications to interpret crafted values as formulas or macros when the file is opened. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by avoiding opening exported RT spreadsheet files directly in spreadsheet applications when the data may contain untrusted user input.

AnalysisAI

Spreadsheet formula injection in Best Practical Request Tracker (RT) allows a low-privileged authenticated attacker to embed malicious formulas in ticket fields that execute when an administrator or staff member exports data to CSV and opens the file in a spreadsheet application. Affected versions span the entire RT 5.0 line prior to 5.0.10 and RT 6.0.0 through 6.0.2. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the attack surface is broad given that CSV exports are a routine administrative workflow in ticketing systems.

Technical ContextAI

RT (Request Tracker) by Best Practical Solutions is an open-source enterprise ticketing platform. The affected component is its spreadsheet export feature, which serializes ticket data - including user-controlled fields such as subject lines, comments, and custom fields - into CSV or Excel-compatible output without sanitizing values that begin with formula-triggering characters (=, +, -, @, TAB, CR). CWE-1236 (Improper Neutralization of Formula Elements in a CSV File) describes exactly this root cause: the application treats user input as raw data but spreadsheet parsers like Microsoft Excel and LibreOffice Calc evaluate leading formula characters as executable instructions upon file open. The CPE cpe:2.3:a:bestpractical:rt:*:*:*:*:*:*:*:* covers all RT versions; the vendor-confirmed affected range is RT < 5.0.10 and RT 6.0.0 through 6.0.2.

RemediationAI

Upgrade to RT 5.0.10 (released 2026-05-20, SHA-256: 508b8d401273da4fe1c47e642ecb6017939ef560e9cfdfeb8d18ef41e4dbc5e6, available at https://download.bestpractical.com/pub/rt/release/rt-5.0.10.tar.gz) or RT 6.0.3 (tagged at https://github.com/bestpractical/rt/releases/tag/rt-6.0.3). The vendor notes this release also addresses higher-severity issues (CVE-2026-44231, CVE-2026-41075) making prompt upgrade strongly advisable. If immediate upgrade is not feasible, the vendor-recommended workaround is to avoid opening RT-exported CSV/spreadsheet files directly in desktop spreadsheet applications such as Excel or LibreOffice Calc when the underlying ticket data may contain untrusted user input. A practical compensating control is to import exports into a spreadsheet with formula evaluation disabled (e.g., Excel's 'Data > From Text/CSV' import with 'Disable formula evaluation' policy enforced via Group Policy) rather than double-clicking the file - this eliminates execution risk without disrupting the reporting workflow. Restricting RT account creation to vetted internal users reduces the attacker's ability to inject malicious content.