ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-93581

Insufficient Neutralization of Formula Elements in CSV Exports

Published Oct 12, 2026 · catalog updated Oct 15, 2026 · OTRS GmbH (former OTRS AG) OTRS

Check if you run it

No confirmed exploitation is on record for CVE-2026-93581. EPSS is 0.19%. Act only if a listed version of OTRS GmbH (former OTRS AG) OTRS is installed.

Gaps on this record

  • No version range is stored. A customer cannot check an installed version against this record.
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium6.1
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.19%
Remediation
Advisory link
Affected products
vendor OTRS GmbH (former OTRS AG) ((OTRS)) Community Edition · vendor OTRS GmbH (former OTRS AG) OTRS

User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authenticated users or received through external communication channels such as email, may be stored in fields that are later included in CSV exports. An attacker can therefore inject values beginning with spreadsheet formula characters such as =, +, -, or @. An attacker does not necessarily require an authenticated account if the affected field can be populated through an external input channel such as incoming email. When an affected CSV file is opened in spreadsheet software, the application may interpret these values as formulas instead of plain text. Depending on the spreadsheet application and its security configuration, a malicious formula may cause unintended actions, disclose information, or invoke external functionality. Exploitation may require the user opening the exported CSV file to confirm one or more security warning dialogs. The vulnerability does not execute code on the OTRS server; any additional impact occurs in the spreadsheet application used to process the exported file. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • vendor OTRS GmbH (former OTRS AG) ((OTRS)) Community Editionversion unspecified
  • vendor OTRS GmbH (former OTRS AG) OTRSversion unspecified

How to fix CVE-2026-93581

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-93581. EPSS is 0.19%. Act only if a listed version of OTRS GmbH (former OTRS AG) OTRS is installed.

Which versions are affected?

Affected version ranges are not on this record. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-1236: Improper Neutralization of Formula Elements in a CSV File. EPSS 0.19%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 12, 2026 · CIRCL Vulnerability Lookup

    Detected

    User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authenticated users or received through external communication channels such as email, may be stored in fields that are later included in CSV exports. An attacker can therefore inject values beginning with spreadsheet formula characters such as =, +,

  2. Oct 15, 2026 · CIRCL Vulnerability Lookup

    Updated

    User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authenticated users or received through external communication channels such as email, may be stored in fields that are later included in CSV exports. An attacker can therefore inject values beginning with spreadsheet formula characters such as =, +,

Sources

  • CIRCL Vulnerability LookupVulnerability recordCVE-2026-93581

    User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authenticated users or received through external communication channels such as email, may be stored in fields that are later incl

    vulnerability.circl.lu
  • CVE.orgVulnerability recordCVE-2026-93581

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-93581

    30-day exploitation probability 0.2%

    first.org

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.