Description
User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authenticated users or received through external communication channels such as email, may be stored in fields that are later included in CSV exports. An attacker can therefore inject values beginning with spreadsheet formula characters such as =, +, -, or @. An attacker does not necessarily require an authenticated account if the affected field can be populated through an external input channel such as incoming email.

When an affected CSV file is opened in spreadsheet software, the application may interpret these values as formulas instead of plain text. Depending on the spreadsheet application and its security configuration, a malicious formula may cause unintended actions, disclose information, or invoke external functionality. Exploitation may require the user opening the exported CSV file to confirm one or more security warning dialogs. The vulnerability does not execute code on the OTRS server; any additional impact occurs in the spreadsheet application used to process the exported file.

This issue affects OTRS:

* 7.0.X
* 8.0.X
* 2023.X
* 2024.X
* 2025.X
* 2026.X before 2026.7.X

Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected
Published: 2026-10-12
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Spreadsheet Formula Injection
Action: Immediate Update
AI Analysis

Impact

The vulnerability arises when user‑controlled content is included in CSV exports without neutralizing spreadsheet formula characters. Attackers can inject strings beginning with =, +, -, or @ into exported data. Opening the CSV in spreadsheet software may cause the program to interpret these strings as formulas, potentially leading to information disclosure, unintended actions, or external function calls. The attack does not allow code execution on the OTRS server; impacts only occur within the spreadsheet application.

Affected Systems

OTRS Community Edition versions 7.0.x, 8.0.x, 2023.x, 2024.x, 2025.x, and 2026.x prior to 2026.7.x are vulnerable. OTRS 6.x Community Edition and earlier, and products based on the Community Edition, are also likely affected.

Risk and Exploitability

The CVSS score of 6.1 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in CISA KEV, suggesting no widespread exploitation yet. Attackers can exploit the flaw via external input such as incoming email or authenticated user actions to write malicious data to fields that will later be exported. Exploitation requires the victim to open the CSV and confirm any security prompts. Because no code runs on the server, risk is limited to user workstations, but if the spreadsheet locates URLs or macros, it could lead to further compromise.

Generated by OpenCVE AI on October 12, 2026 at 08:22 UTC.

Remediation

Vendor Solution

Update to latest version of OTRS (2026.7.1. or later). Please note that there will be no OTRS 7 patches

OpenCVE Recommended Actions

  • Update OTRS to version 2026.7.1 or later; no 7.x patches are available.
  • Configure CSV export settings to escape or prefix potential formula characters (e.g., prepend a single quote) so that spreadsheet software treats the content as plain text.
  • Train users and configure spreadsheet applications to block automatic formula evaluation or require confirmation when opening unknown CSV files.

Generated by OpenCVE AI on October 12, 2026 at 08:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Oct 2026 07:00:00 +0000

Type Values Removed Values Added
Description User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authenticated users or received through external communication channels such as email, may be stored in fields that are later included in CSV exports. An attacker can therefore inject values beginning with spreadsheet formula characters such as =, +, -, or @. An attacker does not necessarily require an authenticated account if the affected field can be populated through an external input channel such as incoming email. When an affected CSV file is opened in spreadsheet software, the application may interpret these values as formulas instead of plain text. Depending on the spreadsheet application and its security configuration, a malicious formula may cause unintended actions, disclose information, or invoke external functionality. Exploitation may require the user opening the exported CSV file to confirm one or more security warning dialogs. The vulnerability does not execute code on the OTRS server; any additional impact occurs in the spreadsheet application used to process the exported file. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected
Title Insufficient Neutralization of Formula Elements in CSV Exports
Weaknesses CWE-1236
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: OTRS

Published:

Updated: 2026-10-12T06:49:31.279Z

Reserved: 2026-09-18T10:57:10.801Z

Link: CVE-2026-93581

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-12T07:16:37.570

Modified: 2026-10-12T07:16:37.570

Link: CVE-2026-93581

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T08:30:07Z

Weaknesses
  • CWE-1236

    Improper Neutralization of Formula Elements in a CSV File