Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-93581— Insufficient Neutralization of Formula Elements in CSV Exports

Quick assessment

Affected
OTRS GmbH (former OTRS AG) OTRS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

当用户可控的值被包含在 CSV 导出文件中时，未能对其进行充分的净化处理。源自用户输入的数据（包括经过身份验证的用户提交的数据，或通过电子邮件等外部通信渠道接收的数据）可能存储在后续会被包含在 CSV 导出中的字段内。因此，攻击者可以注入以电子表格公式字符（如 =、+、- 或 @）开头的值。如果受影响字段可通过外部输入渠道（如传入的电子邮件）进行填充，则攻击者并不需要具备已认证账户。 当受影响的 CSV 文件在电子表格软件中打开时，应用程序可能会将这些值解释为公式而非纯文本。根据所使用的电子表格应用程序及其安全配置

CVSS 6.1 · Medium EPSS 0.19% · P8

Affected Version Matrix 7

VendorProduct Version RangeStatus
OTRS GmbH (former OTRS AG) ((OTRS)) Community Edition 6.x affected
OTRS GmbH (former OTRS AG) OTRS 7.0.x affected
8.0.x affected
2023.x affected
2024.x affected
2025.x affected
2026.x≤ 2026.6.x affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-93581

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Insufficient Neutralization of Formula Elements in CSV Exports
Source: CVE Program / CVE List V5
Vulnerability Description
User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authenticated users or received through external communication channels such as email, may be stored in fields that are later included in CSV exports. An attacker can therefore inject values beginning with spreadsheet formula characters such as =, +, -, or @. An attacker does not necessarily require an authenticated account if the affected field can be populated through an external input channel such as incoming email. When an affected CSV file is opened in spreadsheet software, the application may interpret these values as formulas instead of plain text. Depending on the spreadsheet application and its security configuration, a malicious formula may cause unintended actions, disclose information, or invoke external functionality. Exploitation may require the user opening the exported CSV file to confirm one or more security warning dialogs. The vulnerability does not execute code on the OTRS server; any additional impact occurs in the spreadsheet application used to process the exported file. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1236
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
OTRS GmbH (former OTRS AG) OTRS 7.0.x -
OTRS GmbH (former OTRS AG) ((OTRS)) Community Edition 6.x -

II. Public POCs for CVE-2026-93581

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-93581

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-93581 (1)

Same Patch Batch · OTRS GmbH (former OTRS AG) · 2026-10-12 · 9 CVEs total

CVE-2026-93582 9.4 CRITICAL Authentication Bypass via Spoofed Remote-User Header in HTTP Basic Authentication
CVE-2026-78357 9.1 CRITICAL Insufficient Session Revocation for JWT Authentication
CVE-2026-78355 8.7 HIGH Path Traversal in SendSupportBundle allows File Deletion Outside the Intended Directory
CVE-2026-48211 5.4 MEDIUM Cross-Site Request Forgery in Import/Export Admin console
CVE-2026-78359 5.4 MEDIUM Duplicate Identity / Identity Shadowing across CustomerUser backends
CVE-2026-78356 5.3 MEDIUM Unauthenticated Disclosure of Agent Frontend Configuration
CVE-2026-48212 4.8 MEDIUM Stored XSS in external pages
CVE-2026-78358 4.3 MEDIUM Cross-Site Request Forgery in Administrative Actions

IV. Related Vulnerabilities

Same product: OTRS
Same vendor: OTRS GmbH (former OTRS AG)
Same weakness: CWE-1236

V. Comments for CVE-2026-93581

No comments yet

Leave a comment