Best Practical RT CVE-2026-44229

The attacker must hold a valid RT user account with permission to upload file attachments (PR:L per CVSS vector) - unauthenticated access is insufficient. A second RT user must actively view or download the malicious upload (UI:R); the script does not execute passively on page load of the ticket list. The vulnerable condition is RT's inline content serving behavior, which is present in all affected versions by default and does not require any non-default configuration. Exploitation is bounded by the attacker's ability to create tickets or add attachments and by the requirement that a victim opens the specific attachment. Higher-impact outcomes (admin session hijack) require targeting users with elevated RT roles, which may involve social engineering or waiting for an admin to review a flagged ticket.

The CVSS 5.4 Medium rating with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N accurately characterizes the risk profile. Exploitation requires an authenticated RT account (PR:L) - ruling out unauthenticated internet attackers - and victim interaction (UI:R), meaning the attack does not fire automatically without a second user engaging with the malicious upload. No EPSS score was provided in the available data. The vulnerability is not listed in the CISA KEV catalog and no public POC has been identified, placing this in a lower-urgency tier despite the scope change. Real-world risk is elevated in enterprise environments where RT users implicitly trust ticket attachments from colleagues, making social engineering trivial. The vendor's recommendation for immediate upgrade across both active release branches (5.0.x and 6.0.x) signals they consider the exposure meaningful. The primary risk is session hijacking or privilege escalation by a malicious insider or compromised low-privilege account targeting higher-privilege RT users such as administrators.

An authenticated RT user with standard ticket attachment privileges uploads a crafted HTML file containing a JavaScript payload (e.g., a session cookie stealer) to a high-traffic ticket visible to administrators. When an RT administrator views or clicks the attachment, the inline-served file executes the script in their browser, exfiltrating their session token to an attacker-controlled endpoint. No public POC has been identified, but the attack is technically straightforward for any user familiar with XSS and requires no special tooling.