EUVD-2026-46049Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Stored XSS requires authenticated write access (PR:L) and victim page view (UI:R); scope change reflects cross-user browser execution; no availability impact applies.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3, contain a stored Cross-Site Scripting (XSS) vulnerability, where user-controlled data is rendered without proper HTML escaping. An authenticated user with permission to set the relevant data can inject JavaScript that executes when another RT user views the affected page. This issue has been fixed in version 6.0.3.
AnalysisAI
Stored Cross-Site Scripting in Best Practical RT versions 6.0.0 through 6.0.2 allows an authenticated attacker with write access to inject persistent JavaScript payloads into ticket or configuration data, which then executes in the browsers of other RT users who view the affected pages. The CVSS scope change (S:C) reflects cross-user browser context impact - injected scripts operate in the victim's session, enabling session hijacking or unauthorized actions. No public exploit is identified at time of analysis; vendor-released patch is confirmed in RT 6.0.3, published 2026-05-20.
Technical ContextAI
RT (Request Tracker) is an open-source, enterprise-grade issue and ticket tracking system developed by Best Practical Solutions, identified by CPE cpe:2.3:a:bestpractical:rt:*:*:*:*:*:*:*:*. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored XSS variant: user-supplied data is persisted in the RT database and later re-rendered in HTML responses without adequate output encoding or HTML escaping. This is a classic server-side template rendering failure where untrusted input is reflected into page output without sanitization. The CVSS S:C (scope change) metric confirms the injected script crosses the security boundary from the attacker's write context into the victim's browser execution context, a defining characteristic of stored XSS in multi-user web applications.
RemediationAI
Upgrade to RT 6.0.3, released 2026-05-20, which is confirmed by the vendor to address this stored XSS vulnerability. The release tarball is available at https://download.bestpractical.com/pub/rt/release/rt-6.0.3.tar.gz (SHA-256: 117b53e7a46e82ade662050d98920f1255865ca873d6bec80036085b17dd3dc6). Note that RT 6.0.3 itself contains a missed fix for a separate spreadsheet injection issue (CVE-2026-41073); organizations should also apply the patch at https://github.com/bestpractical/rt/commit/525547751b76cc422015960bae3056f4e8d4351f.patch until RT 6.0.4 is released. If immediate upgrade is not feasible, restrict write permissions on affected data fields to the minimum required set of trusted users, thereby reducing the population of accounts capable of injecting payloads. Content Security Policy (CSP) headers can reduce XSS exploitability as a defense-in-depth measure, though they do not eliminate the underlying vulnerability.
Privilege escalation and information disclosure in Best Practical's Request Tracker (RT) 6.0.0-6.0.2 and versions before
Authenticated SQL injection in Best Practical's Request Tracker (RT) ticketing system affects versions 5.0.0-5.0.9 and 6
Authentication bypass in Best Practical's Request Tracker (RT) versions 5.0.9 and prior, and 6.0.0 through 6.0.2, allows
Cross-site request forgery in Best Practical Request Tracker (RT) versions 6.0.0 through 6.0.2 allows remote attackers t
Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 does not properly restrict access to private callback c
Cross-site request forgery (CSRF) vulnerability in Request Tracker (RT) 3.8.12 and other versions before 3.8.15, and 4.0
Reflected Cross-Site Scripting in Best Practical RT versions 5.0.4-5.0.9 and 6.0.0-6.0.2 allows an unauthenticated attac
Reflected Cross-Site Scripting in RT (Request Tracker) 6.0.0 through 6.0.2 allows an unauthenticated network attacker to
Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote authenticated users with the permissions
Request Tracker (RT) 4.x before 4.0.13 does not properly enforce the DeleteTicket and "custom lifecycle transition" perm
Stored XSS in Best Practical RT (versions 5.0.0-5.0.9 and 6.0.0-6.0.2) allows any authenticated user with file upload pe
Algorithmic complexity vulnerability in Email::Address::List before 0.02, as used in RT 4.2.0 through 4.2.2, allows remo
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today