EUVD-2026-31269
GHSA-79vr-q653-q96g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
No attacker privileges needed to craft URL (PR:N); user must click link (UI:R); XSS crosses into victim browser context scope change (S:C) with low C/I impact.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
3DescriptionCVE.org
Request Tracker is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the "Page" parameter in GET requests. An attacker can craft a URL that, when opened, results in arbitrary JavaScript execution in the victim’s browser.
This vulnerability affects versions from 5.0.4 up to 5.0.9 and from 6.0.0 up to 6.0.2.
AnalysisAI
Reflected XSS in Best Practical Request Tracker via the unsanitized 'Page' GET parameter allows unauthenticated attackers to craft malicious URLs that execute arbitrary JavaScript in a victim's browser session. Affected versions span 5.0.4-5.0.9 and 6.0.0-6.0.2; vendor-released patches (5.0.10 and 6.0.3) are confirmed available. No public exploit identified at time of analysis; EPSS sits at 0.07% (22nd percentile) and SSVC rates current exploitation as none, though the attack is marked automatable due to the ease of bulk-delivering crafted phishing URLs.
Technical ContextAI
Request Tracker (RT) is an open-source, web-based ticketing and issue-tracking system developed by Best Practical Solutions (CPE: cpe:2.3:a:best_practical:request_tracker). The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation - Reflected XSS): RT fails to sanitize or HTML-encode the 'Page' query parameter before echoing it back in HTTP GET responses. Because the injected value is reflected directly into the page's rendered HTML or script context, an attacker can embed arbitrary JavaScript that executes client-side in the victim's browser origin. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) confirms the flaw is reachable over the network with no attack prerequisites beyond convincing a user to open a crafted URL, consistent with a classic reflected XSS attack surface.
RemediationAI
Upgrade Request Tracker to version 5.0.10 (5.0.x branch) or 6.0.3 (6.0.x branch); both are confirmed vendor-released patches with release notes at https://docs.bestpractical.com/release-notes/rt/5.0.10 and https://docs.bestpractical.com/release-notes/rt/6.0.3. Ubuntu administrators should apply the package update described in USN-8506-1. If immediate patching is not feasible, restrict RT web interface access to internal networks or VPN-only, eliminating the attacker's ability to deliver crafted external URLs to users - though this does not protect against insider or spear-phishing scenarios. Additionally, deploying a strict Content Security Policy (CSP) response header (e.g., script-src 'self') as a compensating control can neutralize inline JavaScript injection; note that RT's existing inline script usage may require CSP tuning to avoid breaking legitimate functionality.
More in Request Tracker
View allSQL injection vulnerability in Approvals/ in Request Tracker (RT) 4.0.10 and earlier allows remote attackers to execute
The dashboard subscription interface in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.
Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 allows remote attackers to obtain se
Best Practical Request Tracker (RT) 5 before 5.0.5 allows Information Disclosure via a transaction search in the transac
Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-g
Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed
Best Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive informati
The email gateway in RT (aka Request Tracker) 3.0.0 through 4.x before 4.0.23 and 4.2.x before 4.2.10 allows remote atta
RT (aka Request Tracker) before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to hijack sessions via an RSS fee
Best Practical Solutions RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8, when GnuPG is enabled, allows remote attackers t
Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x befor
Best Practical Request Tracker (RT) before 5.0.3 has an Open Redirect via a ticket search. Rated medium severity (CVSS 6
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today