CVE-2025-61873
Publication date 16 January 2026
Last updated 21 January 2026
Ubuntu priority
Description
Best Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| request-tracker4 | 26.04 LTS resolute |
Needs evaluation
|
| 25.10 questing |
Needs evaluation
|
|
| 24.04 LTS noble |
Needs evaluation
|
|
| 22.04 LTS jammy |
Needs evaluation
|
|
| 20.04 LTS focal |
Needs evaluation
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial | Ignored end of ESM support, was needs-triage | |
| request-tracker5 | 26.04 LTS resolute |
Needs evaluation
|
| 25.10 questing |
Needs evaluation
|
|
| 24.04 LTS noble |
Needs evaluation
|
|
| 22.04 LTS jammy |
Needs evaluation
|
Severity score breakdown
CVSS version: CVSS v3.0
Base score
2.6 · Low
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:L/A:N