The issue arises from unsanitized user data in spreadsheet exports, allowing CSV or formula injection. When a compromised spreadsheet is opened in Excel or other compatible applications, the injected values can be interpreted as formulas or macros, potentially enabling an attacker to execute arbitrary code or read sensitive data. This injection threatens confidentiality, integrity, and can lead to unintended workflow interruption.

The vulnerability affects the RT issue and ticket tracking system distributed by Best Practical, specifically versions prior to 5.0.10 and 6.0.0 through 6.0.2. These releases are still used in some deployments; the workaround notes that the issue is fixed in 5.0.10 and 6.0.3.

The CVSS score of 4.6 places it in the moderate range. EPSS is available but not provided, and it is not listed in CISA KEV. Exploitation requires an exported spreadsheet containing malicious content to be opened by a victim in a spreadsheet application; no network exploit is described. Because the attack depends on user interaction, the effective threat is limited to environments where exporting and opening spreadsheet data is common. Nevertheless, if the spreadsheet is opened automatically or macros are enabled, an attacker could run code or exfiltrate data.