CVE-2026-41073Medium· 4.6▾ Sunlit

RT is an open source, enterprise-grade issue and ticket tracking system

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score25/ 100 · Low

impact 25.3 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

May 22, 2026

Updated

Jul 23, 2026

CVSS

4.6

Vendor

—

Product

—

CWE

CWE-1236

Depth score

25 · Low

EPSS

0.17% · p6

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

EPSS history

Exploit-prediction probability, daily snapshots since Aug 4.

0.2% → 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 126 days

May 22, 2026Published
Disclosed via NVD
Jul 23, 2026Record revised
Last analysed / modified upstream
Aug 4, 2026EPSS first tracked
0.2%
Sep 25, 2026EPSS peak
0.2% → 0.3%

CWE-1236 #nvd

Full technical detail▾

Overview

RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10 and 6.0.0 through 6.0.2 contain a spreadsheet (CSV/formula) injection vulnerability. User-controlled data in spreadsheet exports is not sanitized before being written to the output file, which can cause spreadsheet applications to interpret crafted values as formulas or macros when the file is opened. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by avoiding opening exported RT spreadsheet files directly in spreadsheet applications when the data may contain untrusted user input.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd