OTRS GmbH OTRS Community Edition CSV Export csv injection

Summaryinfo

A vulnerability was found in OTRS GmbH OTRS Community Edition. It has been rated as critical. This impacts an unknown function of the component CSV Export. The manipulation leads to csv injection. This vulnerability is listed as CVE-2026-93581. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in OTRS GmbH OTRS Community Edition (version unknown). It has been rated as critical. This issue affects an unknown function of the component CSV Export. The manipulation with an unknown input leads to a csv injection vulnerability. Using CWE to declare the problem leads to CWE-1236. The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authenticated users or received through external communication channels such as email, may be stored in fields that are later included in CSV exports. An attacker can therefore inject values beginning with spreadsheet formula characters such as =, +, -, or @. An attacker does not necessarily require an authenticated account if the affected field can be populated through an external input channel such as incoming email. When an affected CSV file is opened in spreadsheet software, the application may interpret these values as formulas instead of plain text. Depending on the spreadsheet application and its security configuration, a malicious formula may cause unintended actions, disclose information, or invoke external functionality. Exploitation may require the user opening the exported CSV file to confirm one or more security warning dialogs. The vulnerability does not execute code on the OTRS server; any additional impact occurs in the spreadsheet application used to process the exported file. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected

It is possible to read the advisory at otrs.com. The identification of this vulnerability is CVE-2026-93581 since 09/18/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/12/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-3872). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• OTRS OTRS

Productinfo

Type

• Service Management Software

Vendor

• OTRS GmbH

Name

• OTRS Community Edition

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion