What’s Vulnerable › Vulnerabilities

CVE-2022-25802

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-07-14 · updated 2026-06-17
• Weakness: CWE-79

Description

Best Practical Request Tracker (RT) before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment.

Affected products

• Best Practical Request Tracker: before 4.4.6; from 5.0.0 before 5.0.3 — fixed in 4.4.6, 5.0.3

How to fix

Upgrade to a fixed version: Best Practical Request Tracker 4.4.6, 5.0.3. Check the vendor advisory for mitigations.

References

• https://docs.bestpractical.com/release-notes/rt/4.4.6
• https://docs.bestpractical.com/release-notes/rt/5.0.3
• https://docs.bestpractical.com/release-notes/rt/index.html
• https://docs.bestpractical.com/release-notes/rt/4.4.6
• https://docs.bestpractical.com/release-notes/rt/5.0.3
• https://docs.bestpractical.com/release-notes/rt/index.html

Get alerted when CVE-2022-25802 or the next vulnerability affects your stack