RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting (XSS) vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload content can include JavaScript in the upload that will execute in the browser session of any RT user who later views or downloads it. This issue has been fixed in versions 5.0.10 and 6.0.3.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
bestpractical rt affected
Version Status Constraints
>= 6.0.0, < 6.0.3 affected —
>= 5.0.0, < 5.0.10 affected —

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Bestpractical Subscribe
Rt Subscribe

Project Subscriptions

No data.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6324-1 request-tracker5 security update
Debian DSA Debian DSA DSA-6327-1 request-tracker4 security update
Ubuntu USN Ubuntu USN USN-8506-1 Request Tracker vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/bestpractical/rt/releases/tag/rt-6.0.3 cve-icon
https://github.com/bestpractical/rt/security/advisories/GHSA-x576-pvwp-c2qv cve-icon
History

Mon, 20 Jul 2026 22:30:00 +0000

Type Values Removed Values Added
First Time appeared Bestpractical
Bestpractical rt
Vendors & Products Bestpractical
Bestpractical rt

Mon, 20 Jul 2026 20:00:00 +0000

Type Values Removed Values Added
Description RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting (XSS) vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload content can include JavaScript in the upload that will execute in the browser session of any RT user who later views or downloads it. This issue has been fixed in versions 5.0.10 and 6.0.3.
Title RT: Cross-Site Scripting via inline-served uploaded content
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-20T19:18:25.818Z

Reserved: 2026-05-05T15:42:40.518Z

Link: CVE-2026-44229

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-20T22:15:03Z

Weaknesses