CVE-2025-61873 - Vulnerability Details - OpenCVE

Best Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Changed

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Bestpractical Subscribe	Request Tracker Subscribe

No data.

No data.

No data.

Advisories

Source	ID	Title
Debian DLA	DLA-4349-1	request-tracker4 security update
Debian DSA	DSA-6031-1	request-tracker5 security update
Debian DSA	DSA-6032-1	request-tracker4 security update

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://docs.bestpractical.com/release-notes/rt/index.html

History

Fri, 16 Jan 2026 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 16 Jan 2026 18:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Bestpractical Bestpractical request Tracker
Weaknesses		CWE-1236
CPEs		cpe:2.3:a:bestpractical:request_tracker::::::::
Vendors & Products		Bestpractical Bestpractical request Tracker
Metrics		cvssV3_1 `{'score': 2.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:L/A:N'}`

Fri, 16 Jan 2026 18:30:00 +0000

Type	Values Removed	Values Added
Description		Best Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used.
References		https://docs.bestpractical.com/release-notes/rt/index.html

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2026-01-16T00:00:00.000Z

Updated: 2026-01-16T18:31:10.182Z

Reserved: 2025-10-03T00:00:00.000Z

Link: CVE-2025-61873

Vulnrichment

Updated: 2026-01-16T18:28:29.358Z

NVD

Status : Received

Published: 2026-01-16T19:16:17.990

Modified: 2026-01-16T19:16:17.990

Link: CVE-2025-61873

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-1236

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2025-61873", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-01-16T18:31:10.182Z", "dateReserved": "2025-10-03T00:00:00.000Z", "datePublished": "2026-01-16T00:00:00.000Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Request Tracker", "vendor": "bestpractical", "versions": [{"lessThan": "4.4.9", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "5.0.9", "status": "affected", "version": "5.0", "versionType": "custom"}, {"lessThan": "6.0.2", "status": "affected", "version": "6.0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Best Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1236", "description": "CWE-1236 Improper Neutralization of Formula Elements in a CSV File", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-01-16T18:16:17.553Z"}, "references": [{"url": "https://docs.bestpractical.com/release-notes/rt/index.html"}], "x_generator": {"engine": "enrichogram 0.0.1"}, "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 2.6, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:L/A:N"}}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:bestpractical:request_tracker:*:*:*:*:*:*:*:*", "versionEndExcluding": "4.4.9"}, {"vulnerable": true, "criteria": "cpe:2.3:a:bestpractical:request_tracker:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "5.0.9"}, {"vulnerable": true, "criteria": "cpe:2.3:a:bestpractical:request_tracker:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.0.2"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-16T18:27:46.566310Z", "id": "CVE-2025-61873", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-16T18:31:10.182Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-61873", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-16T18:27:46.566310Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-16T18:28:29.358Z"}}], "cna": {"metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 2.6, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:L/A:N"}}], "affected": [{"vendor": "bestpractical", "product": "Request Tracker", "versions": [{"status": "affected", "version": "0", "lessThan": "4.4.9", "versionType": "custom"}, {"status": "affected", "version": "5.0", "lessThan": "5.0.9", "versionType": "custom"}, {"status": "affected", "version": "6.0", "lessThan": "6.0.2", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://docs.bestpractical.com/release-notes/rt/index.html"}], "x_generator": {"engine": "enrichogram 0.0.1"}, "descriptions": [{"lang": "en", "value": "Best Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1236", "description": "CWE-1236 Improper Neutralization of Formula Elements in a CSV File"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bestpractical:request_tracker:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.4.9"}, {"criteria": "cpe:2.3:a:bestpractical:request_tracker:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.0.9", "versionStartIncluding": "5.0"}, {"criteria": "cpe:2.3:a:bestpractical:request_tracker:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.0.2", "versionStartIncluding": "6.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-01-16T18:16:17.553Z"}}}, "cveMetadata": {"cveId": "CVE-2025-61873", "state": "PUBLISHED", "dateUpdated": "2026-01-16T18:31:10.182Z", "dateReserved": "2025-10-03T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-01-16T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}