OTRS CVE-2026-93581

Exploitation requires that user-controlled data (from authenticated users, web forms, or external channels such as incoming email routed into OTRS queues) be stored in a field that is subsequently included in a CSV export, and that a user then open that CSV in spreadsheet software. Per the description, the victim must generally confirm one or more spreadsheet security-warning dialogs before a formula executes, which is the primary limiting factor - modern spreadsheet defaults block or warn on such formulas. Additional limits: impact is confined to the victim's spreadsheet application (no code execution on the OTRS server), and the attacker depends on an export workflow actually being used and the victim ignoring warnings. The external-email input path means an authenticated account is not strictly required for data delivery.

This is a CSV/formula injection flaw (CWE-1236) with a moderate CVSS 3.1 score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The vector's PR:N indicates no authentication is required, and the description reinforces this by noting that affected fields can be populated through external channels such as incoming email, lowering the barrier to delivery. However, the attack is fundamentally gated by UI:R: a victim must open the exported CSV in spreadsheet software AND, per the description, typically click through one or more security-warning dialogs for a formula to execute - a significant real-world mitigation that modern Excel/LibreOffice defaults enforce. No EPSS score, KEV listing, POC, or SSVC data was provided in the input, so exploitation likelihood cannot be quantified from these signals; based on available data there is no public exploit identified at time of analysis. The impact is also indirect - code does not run on the OTRS server, only within the victim's spreadsheet application (reflected in S:C and the limited C:L/I:L/A:N). Net assessment: a legitimate but lower-tier issue. The network/unauthenticated delivery path raises it above a trivial bug, but the dependence on victim interaction and security-dialog confirmation makes widespread automatable exploitation unlikely. This is a 'patch in normal cycle' item rather than an emergency, absent any evidence of active exploitation.

An attacker sends an email to an OTRS-monitored queue (e.g., a support address) containing a field value beginning with a formula character such as =, +, -, or @, which OTRS stores and later includes verbatim in a CSV export. When an agent or administrator opens that exported CSV in spreadsheet software and confirms the security-warning prompts, the embedded formula is interpreted and may trigger data disclosure or invoke external functionality on the victim's workstation. No public exploit code was identified in the provided data.