CVE-2026-41073 — Bestpractical RT vulnerability

Vendor	Product	Version range	Fixed in
bestpractical	rt	< 5.0.10	5.0.10
bestpractical	rt	—	—
ubuntu	request-tracker5	—	—

Ubuntu

Request Tracker vulnerabilities

vendor_ubuntu·2026-07-06·CVSS 4.6

CVE-2026-44231 [MEDIUM] Request Tracker vulnerabilities Title: Request Tracker vulnerabilities Summary: Several security issues were fixed in Request Tracker. Aleksander Iwicki discovered that Request Tracker did not properly sanitize the search "Page" URL parameter. A remote attacker could possibly use this issue to conduct a reflected cross-site scripting attack. (CVE-2026-6841) It was discovered that Request Tracker did not properly sanitize user- controlled data written to spreadsheet exports of search results. A remote attacker could possibly use this issue to conduct a spreadsheet (CSV/formula) injection attack, causing spreadsheet applications to interpret crafted values as formulas or macros when the file is opened. (CVE-2026-41073) It was discovered that Request Tracker did not properly validate input incorporated into database que

VulDB

bestpractical rt up to 5.0.9/6.0.2 csv injection (GHSA-6x92-7v65-7m3r)

vuldb·2026-05-23

CVE-2026-41073 [LOW] bestpractical rt up to 5.0.9/6.0.2 csv injection (GHSA-6x92-7v65-7m3r) A vulnerability has been found in bestpractical rt up to 5.0.9/6.0.2 and classified as problematic. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in csv injection. This vulnerability is reported as CVE-2026-41073. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

CVEList

RT: Spreadsheet downloads vulnerable to CSV/formula injection in Microsoft Excel and similar apps

cvelistv5·2026-05-22·CVSS 4.6

CVE-2026-41073 [MEDIUM] CWE-1236 RT: Spreadsheet downloads vulnerable to CSV/formula injection in Microsoft Excel and similar apps RT: Spreadsheet downloads vulnerable to CSV/formula injection in Microsoft Excel and similar apps RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10 and 6.0.0 through 6.0.2 contain a spreadsheet (CSV/formula) injection vulnerability. User-controlled data in spreadsheet exports is not sanitized before being written to the output file, which can cause spreadsheet applications to interpret crafted values as formulas or macros when the file is opened. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by avoiding opening exported RT spreadsheet files directly in spreadsheet applications when the data may contain untrusted user input.

CVE-2026-41073: RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10 and 6.0.0 through 6.0.2 contain a spreadsheet (CSV/formula)…

Affected

CVSS provenance