EUVD-2026-46078Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Authenticated upload (PR:L) over network (AV:N); victim must open file (UI:R); XSS executes in victim's browser scope (S:C) with limited confidentiality and integrity impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting (XSS) vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload content can include JavaScript in the upload that will execute in the browser session of any RT user who later views or downloads it. This issue has been fixed in versions 5.0.10 and 6.0.3.
AnalysisAI
Stored XSS in Best Practical RT (versions 5.0.0-5.0.9 and 6.0.0-6.0.2) allows any authenticated user with file upload permissions to embed malicious JavaScript in an uploaded file that executes in the browser session of any RT user who later views or downloads that content. The root cause is RT serving uploaded files inline rather than forcing browser download via Content-Disposition: attachment, enabling browsers to render and execute embedded scripts. Vendor-released patches 5.0.10 and 6.0.3 are available (released 2026-05-20); no public exploit identified at time of analysis.
Technical ContextAI
RT (Request Tracker) is an enterprise issue and ticket tracking system developed by Best Practical Solutions, commonly used by IT operations, legal, and support teams. The CPE cpe:2.3:a:bestpractical:rt:*:*:*:*:*:*:*:* covers all RT application instances. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS), specifically arising from the HTTP response Content-Disposition or Content-Type header being set to inline when serving user-uploaded attachments. This allows browsers to interpret and execute HTML or JavaScript embedded within uploaded files rather than prompting the user to save the file locally. The scope change (S:C in CVSS) is characteristic of stored XSS: the injected script runs in a different user's browser security context, not the attacker's.
RemediationAI
Upgrade to RT 5.0.10 or RT 6.0.3 immediately, as recommended by the vendor. The RT 6.0.3 release tarball is available at https://download.bestpractical.com/pub/rt/release/rt-6.0.3.tar.gz (SHA-256: 117b53e7a46e82ade662050d98920f1255865ca873d6bec80036085b17dd3dc6). Users on the 6.0.x branch should also apply the separate patch at https://github.com/bestpractical/rt/commit/525547751b76cc422015960bae3056f4e8d4351f.patch to address CVE-2026-41073 (TSV export header injection inadvertently omitted from 6.0.3; will be included in 6.0.4). If an immediate upgrade is not feasible, restrict file upload permissions to the minimum set of trusted users as a compensating control - this does not eliminate the flaw but reduces the attacker pool. Note that restricting upload permissions may impact normal ticket workflows. The full vendor advisory is at https://github.com/bestpractical/rt/security/advisories/GHSA-x576-pvwp-c2qv.
Privilege escalation and information disclosure in Best Practical's Request Tracker (RT) 6.0.0-6.0.2 and versions before
Authenticated SQL injection in Best Practical's Request Tracker (RT) ticketing system affects versions 5.0.0-5.0.9 and 6
Authentication bypass in Best Practical's Request Tracker (RT) versions 5.0.9 and prior, and 6.0.0 through 6.0.2, allows
Cross-site request forgery in Best Practical Request Tracker (RT) versions 6.0.0 through 6.0.2 allows remote attackers t
Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 does not properly restrict access to private callback c
Cross-site request forgery (CSRF) vulnerability in Request Tracker (RT) 3.8.12 and other versions before 3.8.15, and 4.0
Reflected Cross-Site Scripting in Best Practical RT versions 5.0.4-5.0.9 and 6.0.0-6.0.2 allows an unauthenticated attac
Reflected Cross-Site Scripting in RT (Request Tracker) 6.0.0 through 6.0.2 allows an unauthenticated network attacker to
Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote authenticated users with the permissions
Request Tracker (RT) 4.x before 4.0.13 does not properly enforce the DeleteTicket and "custom lifecycle transition" perm
Stored Cross-Site Scripting in Best Practical RT versions 6.0.0 through 6.0.2 allows an authenticated attacker with writ
Algorithmic complexity vulnerability in Email::Address::List before 0.02, as used in RT 4.2.0 through 4.2.2, allows remo
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today