Read the docs
TI-2026-29711 Aliases CVE-2026-41073

RT: Spreadsheet downloads vulnerable to CSV/formula injection in Microsoft Excel and similar apps

Priority LOW 20CWE-1236Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10 and 6.0.0 through 6.0.2 contain a spreadsheet (CSV/formula) injection vulnerability. User-controlled data in spreadsheet exports is not sanitized before being written to the output file, which can cause spreadsheet applications to interpret crafted values as formulas or macros when the file is opened. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by avoiding opening exported RT spreadsheet files directly in spreadsheet applications when the data may contain untrusted user input.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00166 5th percentileScored 2026-11-07
Fix Fixed rt (bestpractical): 5.0.10, 6.0.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
bestpracticalrtbefore 5.0.10; 6.0.0 to before 6.0.35.0.10, 6.0.3Patch availableCNA
  • rt Vendorbestpractical Affected before 5.0.10; 6.0.0 to before 6.0.3 Fixed in 5.0.10, 6.0.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:bestpractical:request_tracker:*:*:*:*:*:*:*:*——bestpractical
  • cpe:2.3:a:bestpractical:request_tracker:*:*:*:*:*:*:*:* Versions — — ·bestpractical

Remediation

  • Fix · CNA rt (bestpractical) Fixed in 5.0.10, 6.0.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41073

References

Other 3

  • TI-2017-03862 The dashboard subscription interface in Request Tracker (RT) 4.x before 4.0.25, 4.2.x… CVSS 3.0HIGH 8.8
  • TI-2023-21864 Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information… CVSS 3.1HIGH 7.5
  • TI-2022-09372 Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via Scripted Action tools. CVSS 3.1CRITICAL 9.1
  • TI-2022-09371 Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via the whois lookup tool. CVSS 3.1CRITICAL 9.1
  • TI-2026-29713 RT: SQL injection via entry_aggregator parameter in JSON search CVSS 3.1HIGH 8.8
  • TI-2023-24078 Best Practical Request Tracker (RT) 5 before 5.0.5 allows Information Disclosure via a… CVSS 3.1HIGH 7.5
See all 76 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences