Description

User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authenticated users or received through external communication channels such as email, may be stored in fields that are later included in CSV exports. An attacker can therefore inject values beginning with spreadsheet formula characters such as =, +, -, or @. An attacker does not necessarily require an authenticated account if the affected field can be populated through an external input channel such as incoming email. When an affected CSV file is opened in spreadsheet software, the application may interpret these values as formulas instead of plain text. Depending on the spreadsheet application and its security configuration, a malicious formula may cause unintended actions, disclose information, or invoke external functionality. Exploitation may require the user opening the exported CSV file to confirm one or more security warning dialogs. The vulnerability does not execute code on the OTRS server; any additional impact occurs in the spreadsheet application used to process the exported file. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-10-12T07:16:37.570Z",
  "pubdate": "2026-10-12T07:16:37.570Z",
  "executiveSummary": "This vulnerability is classified as CSV Injection (also known as Formula Injection). It occurs because the OTRS platform fails to neutralize user-supplied input before exporting it into CSV file formats. By injecting malicious spreadsheet formula characters such as '=', '+', '-', or '@', an attacker can manipulate the behavior of spreadsheet software upon opening the exported file.\nThe vulnerability affects OTRS versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X prior to 2026.7.X, including legacy ((OTRS)) Community Edition 6.x and earlier. The impact is primarily restricted to the client-side spreadsheet application, potentially leading to unauthorized information disclosure, execution of unintended external functionality, or remote requests, depending on the victim's spreadsheet software configuration. Exploitation does not require authentication if the input vector is accessible via external channels like email. While it does not compromise the OTRS server directly, it poses a significant risk to end-users who process exported data, often requiring the bypass of user-interface security warnings.",
  "technicalDetails": "The root cause of this vulnerability is improper neutralization of special characters when generating CSV exports. OTRS facilitates the storage of user-provided data within system fields. When these fields are exported into a CSV format, the system fails to prepend a protective character (such as a single quote) to neutralize data that begins with spreadsheet formula operators.\nThe attack flow begins when an attacker supplies a payload containing spreadsheet formulas (e.g., '=cmd|'/C calc'!A0' or similar DDE-style payloads) into any field that OTRS later includes in a CSV report. This input can be introduced through various vectors, including ticket responses, customer notes, or external communications received via email integration. Once the malicious data is stored in the OTRS database, an administrative or authorized user triggers an export of the data via the OTRS interface.\nUpon opening the resulting CSV file in spreadsheet software, the application parses the cell content. If the software is configured to evaluate formulas, it interprets the leading characters ('=', '+', '-', '@') as triggers for dynamic evaluation. This results in the execution of the injected logic within the context of the user's local spreadsheet environment. This mechanism allows the attacker to execute remote commands, initiate unauthorized outbound network connections to exfiltrate data, or perform local system operations, contingent on the specific spreadsheet application's security policy and user interaction.\nExploitation does not involve server-side code execution. Instead, it leverages the trust relationship between the user and their spreadsheet software. While modern spreadsheet applications often display security warnings regarding dynamic data exchange or external links, the effectiveness of the attack relies on the social engineering of the user to confirm these dialogs or the pre-existing configuration of the software to automatically execute such formulas. This vulnerability is present in versions 7.0.X through 2026.X (pre-2026.7.X) and legacy editions 6.x and below."
}