CVE-2026-93581: CWE-1236 Improper Neutralization of Formula Elements in a CSV File. in OTRS GmbH (former OTRS AG) OTRS

This vulnerability involves improper neutralization of formula elements in CSV exports generated by OTRS software. User input, including from authenticated users or external sources like email, can be stored in fields exported as CSV. If these fields contain characters such as =, +, -, or @ at the start, spreadsheet software may interpret them as formulas rather than plain text. This can lead to unintended actions or information disclosure within the spreadsheet application environment. The vulnerability affects OTRS versions 6.x through 2026.6.x before the 2026.7.X release. Exploitation requires user interaction to open the CSV file and acknowledge any security prompts. The issue does not involve code execution on the OTRS server itself.

The impact is limited to the environment where the exported CSV file is opened. Malicious formulas in the CSV may cause unintended actions, information disclosure, or invoke external functionality depending on the spreadsheet software and its security settings. There is no direct impact on the OTRS server or its data. Exploitation requires user interaction to open the file and potentially confirm security warnings. The vulnerability could be exploited without authentication if the attacker can inject data via external channels such as email.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should exercise caution when opening CSV files exported from OTRS, especially those containing user-generated content. Spreadsheet applications should be configured to disable automatic formula execution or prompt users before executing formulas. Review and sanitize inputs that may be included in CSV exports where possible.