EUVD-2026-46080Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered reflected XSS; attacker needs no credentials (PR:N); victim must actively load crafted URL (UI:R); browser context escape justifies S:C; session-limited confidentiality and integrity impact (C:L/I:L); no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to (but not including) 5.0.10, and 6.0.0 up to (but not including) 6.0.3 contain a reflected Cross-Site Scripting (XSS) vulnerability where an attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's browser session. This issue has been fixed in versions 5.0.10 and 6.0.3.
AnalysisAI
Reflected Cross-Site Scripting in Best Practical RT versions 5.0.4-5.0.9 and 6.0.0-6.0.2 allows an unauthenticated attacker to execute arbitrary JavaScript in the browser session of an authenticated RT user by inducing that user to visit a specially crafted URL. The CVSS vector's Changed scope (S:C) indicates the injected script can impact browser security context beyond the vulnerable RT component itself, including potential session hijacking or in-browser data exfiltration. Vendor-released patches are confirmed in versions 5.0.10 and 6.0.3 (released 2026-05-20); no active exploitation has been identified at time of analysis.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: the RT web application reflects attacker-controlled input in HTTP responses without adequate sanitization or encoding, enabling the browser to interpret that input as executable script. RT is a Perl-based, enterprise-grade issue tracking system developed by Best Practical Solutions, identified by CPE cpe:2.3:a:bestpractical:rt:*:*:*:*:*:*:*:*. The CVSS Scope:Changed metric is particularly significant for XSS - it indicates the malicious script escapes the application's security boundary and operates within the victim's browser context, which is treated as a separate security authority. This class of vulnerability commonly arises in web applications that include request parameters (URL query strings, path segments, or headers) directly in rendered HTML responses without encoding special characters such as angle brackets and quotes.
RemediationAI
Upgrade to RT 5.0.10 or RT 6.0.3, both confirmed to contain the fix per vendor release notes dated 2026-05-20. The RT 6.0.3 tarball is available at https://download.bestpractical.com/pub/rt/release/rt-6.0.3.tar.gz with SHA-256 117b53e7a46e82ade662050d98920f1255865ca873d6bec80036085b17dd3dc6. Note that RT 6.0.3 users should additionally apply the manual patch at https://github.com/bestpractical/rt/commit/525547751b76cc422015960bae3056f4e8d4351f.patch for the separately tracked TSV export header injection (CVE-2026-41073), which was inadvertently omitted from 6.0.3 and will be included in 6.0.4. If immediate patching is not feasible, restrict the RT web interface to internal networks or VPN-only access to eliminate the most common delivery vector for crafted URLs; this does not eliminate risk from insider threats but significantly reduces external attack surface. User awareness training to avoid clicking unsolicited links to RT pages provides a secondary control layer, though it should not be relied upon as a primary mitigation.
Privilege escalation and information disclosure in Best Practical's Request Tracker (RT) 6.0.0-6.0.2 and versions before
Authenticated SQL injection in Best Practical's Request Tracker (RT) ticketing system affects versions 5.0.0-5.0.9 and 6
Authentication bypass in Best Practical's Request Tracker (RT) versions 5.0.9 and prior, and 6.0.0 through 6.0.2, allows
Cross-site request forgery in Best Practical Request Tracker (RT) versions 6.0.0 through 6.0.2 allows remote attackers t
Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 does not properly restrict access to private callback c
Cross-site request forgery (CSRF) vulnerability in Request Tracker (RT) 3.8.12 and other versions before 3.8.15, and 4.0
Reflected Cross-Site Scripting in RT (Request Tracker) 6.0.0 through 6.0.2 allows an unauthenticated network attacker to
Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote authenticated users with the permissions
Request Tracker (RT) 4.x before 4.0.13 does not properly enforce the DeleteTicket and "custom lifecycle transition" perm
Stored XSS in Best Practical RT (versions 5.0.0-5.0.9 and 6.0.0-6.0.2) allows any authenticated user with file upload pe
Stored Cross-Site Scripting in Best Practical RT versions 6.0.0 through 6.0.2 allows an authenticated attacker with writ
Algorithmic complexity vulnerability in Email::Address::List before 0.02, as used in RT 4.2.0 through 4.2.2, allows remo
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today