RTIR CVE-2026-105456

RTIR must be installed on the RT instance - installation is what alters RT's HTML scrubber globally to accept links containing the internal-link placeholder, including javascript: scheme URIs, across the whole instance and not just RTIR queues. To plant the payload unauthenticated, the Incident Reports queue must accept HTML email from external senders, which is RTIR's default. The limiting factor is required victim interaction (UI:P): the stored script does not fire automatically - a logged-in RT user must open the ticket and click the crafted link, and the resulting actions are bounded by that specific user's RT authority. Any user who can add HTML content to a ticket (including the unauthenticated email path) can store the link, so the main constraint on real-world impact is getting a privileged user to click.

This is a stored cross-site scripting flaw (CWE-79) in RTIR's extension of RT's HTML scrubber, which whitelists any link containing an internal-link placeholder and thereby lets javascript: scheme URIs through. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N, base 5.3) is consistent with the description: network-reachable, low complexity, no privileges to plant the payload, but requiring victim interaction (clicking the link), with limited confidentiality/integrity impact in both the vulnerable and a subsequent system (the victim's browser/session). The vuln.today decision label is 'this_month' (not act_now/emergency), indicating a prioritized but non-emergency fix. No EPSS score, no CISA KEV listing, and no confirmed exploit code are present in the input, so this is not confirmed as actively exploited; it is a genuine, prioritizable stored-XSS issue rather than a drop-everything event. The notable risk amplifier stated in the evidence is that installing RTIR changes the scrubber behavior for the ENTIRE RT instance (not just RTIR queues), and the Incident Reports queue accepts HTML email from anyone by default - so the attacker's barrier to planting a payload is unusually low even though successful execution still depends on a victim clicking the malicious link.

An attacker sends an HTML email to the Incident Reports queue - which RTIR opens to unauthenticated senders by default - containing a link whose href uses the javascript: scheme but also includes the internal-link placeholder so the scrubber permits it. When an RT user later opens that ticket and clicks the link, the script runs in that user's authenticated session and can act in RT with that user's authority. No public exploit identified at time of analysis.