p PatchFirst

CVE-2025-61873

CVE-2025-61873

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Best Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used.

CVSS 2.6 · Low · EPSS 0.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • request tracker

    Versions
    • ≥ 0, < 4.4.9: Affected (custom)
    • ≥ 5.0, < 5.0.9: Affected (custom)
    • ≥ 6.0, < 6.0.2: Affected (custom)

    Update to 4.4.9; Update to 5.0.9; Update to 6.0.2

  • request-tracker4 Debian:12

    Versions
    • 4.4.6+dfsg-1.1
    • 4.4.6+dfsg-1.1+deb12u1
    • 4.4.6+dfsg-1.1+deb12u2
    Affected ranges
    • ECOSYSTEM: < 4.4.6+dfsg-1.1+deb12u3

    Update to 4.4.6+dfsg-1.1+deb12u3

  • request-tracker5 Debian:12

    Versions
    • 5.0.3+dfsg-2
    • 5.0.3+dfsg-3~deb12u1
    • 5.0.3+dfsg-3~deb12u2
    • 5.0.3+dfsg-3~deb12u3
    Affected ranges
    • ECOSYSTEM: < 5.0.3+dfsg-3~deb12u4

    Update to 5.0.3+dfsg-3~deb12u4

  • request-tracker5 Debian:13

    Versions
    • 5.0.7+dfsg-4
    Affected ranges
    • ECOSYSTEM: < 5.0.7+dfsg-4+deb13u1

    Update to 5.0.7+dfsg-4+deb13u1

  • request-tracker5 Debian:14

    Versions
    • 5.0.7+dfsg-4
    Affected ranges
    • ECOSYSTEM: < 5.0.7+dfsg-5

    Update to 5.0.7+dfsg-5

  • request-tracker4 Ubuntu:16.04:LTS

    Versions
    • 4.2.11-2
    • 4.2.12-3
    • 4.2.12-4
    • 4.2.12-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • request-tracker4 Ubuntu:Pro:18.04:LTS

    Versions
    • 4.4.1-5
    • 4.4.2-1
    • 4.4.2-2
    • 4.4.2-2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • request-tracker4 Ubuntu:20.04:LTS

    Versions
    • 4.4.3-2
    • 4.4.3-2+deb10u3build0.20.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • request-tracker4 Ubuntu:22.04:LTS

    Versions
    • 4.4.4+dfsg-2ubuntu1
    • 4.4.4+dfsg-2ubuntu1.22.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • request-tracker4 Ubuntu:24.04:LTS

    Versions
    • 4.4.4+dfsg-2ubuntu1
    • 4.4.4+dfsg-2ubuntu2
    • 4.4.7+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • request-tracker4 Ubuntu:25.10

    Versions
    • 4.4.7+dfsg-4syncable1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • request-tracker4 Ubuntu:26.04:LTS

    Versions
    • 4.4.7+dfsg-4syncable1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →