CVE-2026-93581

User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authenticated users or received through external communication channels such as email, may be stored in fields that are later included in CSV exports. An attacker can therefore inject values beginning with spreadsheet formula characters such as =, +, -, or @. An attacker does not necessarily require an authenticated account if the affected field can be populated through an external input channel such as incoming email. When an affected CSV file is opened in spreadsheet software, the application may interpret these values as formulas instead of plain text. Depending on the spreadsheet application and its security configuration, a malicious formula may cause unintended actions, disclose information, or invoke external functionality. Exploitation may require the user opening the exported CSV file to confirm one or more security warning dialogs. The vulnerability does not execute code on the OTRS server; any additional impact occurs in the spreadsheet application used to process the exported file. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected

• CWE-1236

• https://otrs.com/release-notes/otrs-security-advisory-2026-17/

Published

Oct 12, 2026

Last Modified

Oct 15, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-93576A flaw was found in Netty netty-codec-smtp. The component do…7.5
• CVE-2026-93577GitLab has remediated an issue in GitLab CE/EE affecting all…9.9
• CVE-2026-93578A flaw was found in Netty's Online Certificate Status Protoc…5.9
• CVE-2026-93579A flaw was found in Netty's HTTP/2 stack. This vulnerability…6.5
• CVE-2026-9358A vulnerability was determined in postcss-selector-parser up…4.3
• CVE-2026-93580The InPost PL WordPress plugin before 1.9.8 does not verify …5.3
• CVE-2026-93582The HTTP Basic Authentication modules in ((OTRS)) Community …9.4
• CVE-2026-93586ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a …3.3
• CVE-2026-93587ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a …3.3
• CVE-2026-93588ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a …4.3
• CVE-2026-93589ImageMagick before 7.1.2-31 and 6.9.13-56 contains a divisio…7.5
• CVE-2026-9359A vulnerability was identified in Edimax EW-7438RPn 1.28a. A…6.3