Request Tracker EUVD-2026-114131

Exploitation requires that RT auto-link URLs in HTML ticket content (the vulnerable default behavior) and that an attacker can add HTML content to a ticket. The highest-reach path is an RT queue configured to grant CreateTicket or ReplyToTicket to Everyone and to accept HTML email from the public - described as routine for public mail-handling queues - which removes any authentication requirement. The payload only fires when a user subsequently views the affected ticket's history (UI:P / passive user interaction), so a victim must open the ticket; the resulting script runs only with that viewing user's RT authority, not system-level access. On queues that do not expose CreateTicket/ReplyToTicket to Everyone, an attacker would instead need some account able to submit HTML ticket content, narrowing reach to authenticated users.

This is a stored (persistent) cross-site scripting flaw (CWE-79) in Request Tracker rated CVSS 4.0 base 5.3 (Medium) using the vendor/CERT-PL vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N. The network vector, low complexity, no attack requirements and PR:N are consistent with the description's unauthenticated email-to-queue delivery path, while UI:P (passive) matches the fact that the payload fires automatically when any user merely views the ticket history - no click is needed, only that someone opens the ticket. The low VC/VI and subsequent-system SC/SI reflect that the script runs with the viewing user's RT authority rather than granting full system compromise. Weighing the signals: the vuln.today Decision label is 'this_month' (not act_now or emergency), there is no EPSS probability supplied, no CISA KEV listing, and no proof-of-concept or exploit reference in the inputs - so this is a credible real issue but not an active-exploitation emergency. The main risk amplifier not captured by the base score is that queues accepting public HTML email (CreateTicket/ReplyToTicket granted to Everyone) are routine, which removes the authentication barrier and lets an outside attacker plant the payload; the main limiter is that an agent/user must actually open the malicious ticket for the script to run. Net: a genuine, patch-this-cycle XSS with realistic unauthenticated reach on public-facing RT queues, consistent with its Medium rating rather than an overstated high-CVSS-but-low-risk case.

An attacker sends an HTML email containing a specially crafted URL to a public RT queue that grants CreateTicket or ReplyToTicket to Everyone. RT's auto-linking places the un-escaped URL into the ticket's HTML, breaking out of the link to inject a script. When a support agent later opens the ticket's history, the script executes in that agent's authenticated RT session and can act with their privileges. Given AV:N/AC:L/PR:N, the delivery is trivially reachable; no public exploit code is identified in the available data.