# CVE-2026-41073: Best Practical RT spreadsheet injection in ticket exports

Source: https://junglewise.ai/threats/cve-2026-41073-best-practical-rt-spreadsheet-injection-in-ticket-exports  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-22. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-41073 · Severity: medium · CVSS 4.6 · Published 2026-05-22

Best Practical RT, an enterprise ticket tracking system, is vulnerable to spreadsheet injection. An attacker can input malicious data into a ticket that, when exported to a CSV or Excel file by another user, could execute unauthorized commands or formulas on that user's computer. This could lead to the theft of sensitive information or unauthorized data modification on the victim's local system.

Technologies: [Best Practical Solutions RT](https://junglewise.ai/threats/technologies/rt). Vendors: [Best Practical Solutions](https://junglewise.ai/threats/vendors/best-practical-solutions).

## Quick answers

**Is CVE-2026-41073 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41073 being exploited in the wild.

**How severe is CVE-2026-41073?** Medium severity, with a CVSS score of 4.6, published 22 May 2026.

**Which products and versions are affected?** Best Practical Solutions RT < 5.0.10, 6.0.0 - 6.0.2.

**Is there a fix for CVE-2026-41073?** A patch was published on 2026-05-20: Versions 5.0.10 and 6.0.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41073 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-41073?** Check whether you run Best Practical Solutions RT at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A CSV/formula injection vulnerability (CWE-1236) exists in RT's spreadsheet export functionality. User-controlled data in ticket values is not properly sanitized before being written to export files, allowing an attacker with low privileges to inject crafted values starting with formula characters (e.g., =, +, -, @). When a victim exports these results and opens the file in a spreadsheet application like Microsoft Excel, the application may interpret these values as formulas or macros. This can lead to information disclosure or limited integrity impact on the victim's machine. The issue is fixed in versions 5.0.10 and 6.0.3, though users of 6.0.3 should also apply a manual patch for TSV export headers.

## Affected products

- Best Practical RT (Request Tracker) < 5.0.10, 6.0.0 - 6.0.2

## Timeline

- 2026-05-20: patched: Versions 5.0.10 and 6.0.3 released
- 2026-05-22: advisory: NVD publication date

## References

- [https://github.com/bestpractical/rt/releases/tag/rt-5.0.10](https://github.com/bestpractical/rt/releases/tag/rt-5.0.10)
- [https://github.com/bestpractical/rt/releases/tag/rt-6.0.3](https://github.com/bestpractical/rt/releases/tag/rt-6.0.3)
- [https://github.com/bestpractical/rt/security/advisories/GHSA-6x92-7v65-7m3r](https://github.com/bestpractical/rt/security/advisories/GHSA-6x92-7v65-7m3r)

## Related threats

- [Best Practical RT reflected XSS in search results chart](https://junglewise.ai/threats/cve-2026-44230-best-practical-rt-reflected-xss-in-search-results-chart)
- [Best Practical RT stored XSS via insufficient template escaping](https://junglewise.ai/threats/cve-2026-44228-best-practical-rt-stored-xss-via-insufficient-template-escaping)
- [Best Practical RT reflected XSS in search page URL parameters](https://junglewise.ai/threats/cve-2026-44227-best-practical-rt-reflected-xss-in-search-page-url-parameters)
- [Best Practical RT authentication bypass in LDAP authentication](https://junglewise.ai/threats/cve-2026-41076-best-practical-rt-authentication-bypass-in-ldap-authentication)