Spreadsheet Formula Injection in OTRS Product by OTRS Group

CVE-2026-93581

What is CVE-2026-93581?

The vulnerability exists due to inadequate neutralization of user-controlled input included in CSV exports of the OTRS product. When a user inputs data—whether through authenticated sessions or external communications—the values may be recorded in a format that allows for the injection of spreadsheet formula characters like =, +, -, or @. Once this malicious CSV file is opened in spreadsheet software, formulas embedded within the data could be executed, potentially leading to undesired behavior, data disclosure, or interaction with external functionalities. Users might need to acknowledge warnings from their spreadsheet application before any malicious actions occur. This issue is notably concerning for all affected versions of OTRS prior to 2026.7.X.

References