RTIR EUVD-2026-114130

Two preconditions must hold. First, an attacker must be able to submit an Incident Report whose subject they control - satisfied by default because RTIR grants everyone the right to create Incident Reports, so an unauthenticated, remote sender can set the subject via an emailed report. Second, an authenticated incident handler must open one of the specific affected forms - splitting a ticket, or creating an incident from a report - which renders the attacker-controlled subject without HTML escaping and executes the script in that handler's RT session. Limiting factors: exploitation is passive-user-interaction dependent (the handler must open the form), impact is confined to the acting handler's RT privileges, and only RTIR 6.x before 6.0.4 is affected - RTIR 5.0 is explicitly not affected. The complete fix is upgrading to RTIR 6.0.4 as stated by the vendor.

This is a medium-severity stored cross-site scripting flaw (CWE-79) in RTIR's ticket-creation workflows, and the supplied signals are internally consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) correctly reflects a two-party design: the attacker who plants the payload is unauthenticated and remote (PR:N), because RTIR grants everyone the right to create Incident Reports by default, so a payload can be delivered simply by emailing a report with a scripted subject; execution, however, is gated on an incident handler opening the split or create-incident form (UI:P / Passive user interaction). The vuln.today priority is 'this_month', not act_now or emergency, and there is no CISA KEV listing, no EPSS probability supplied, and no proof-of-concept or exploit reference in the input - so there is no evidence of active exploitation or public exploit code. Impact is explicitly partial (VC:L/VI:L, VA:N) and bounded by the privileges of the targeted handler's RT session rather than yielding full account or system compromise. Net: a genuine, credible stored-XSS risk against incident responders that warrants scheduled patching, but not an emergency; its real-world urgency is tempered by the required handler interaction and the modest, session-scoped impact. Note the primary reference URL cites CVE-2026-105454, one digit off from this CVE ID - the advisory linkage should be verified with CERT-PL/Best Practical.

An attacker emails an Incident Report to an RTIR instance (allowed to anyone by default) with a ticket subject containing a malicious <script> payload. When an incident handler later opens the form to split that ticket or create an incident from the report, the unescaped subject executes JavaScript in the handler's authenticated RT session, letting it act with that handler's authority. No public exploit code or PoC reference is present in the supplied data.