What’s Vulnerable › Vulnerabilities

CVE-2026-44228: RT: Stored Cross-Site Scripting via insufficient template escaping

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-20 · updated 2026-10-24
• Weakness: CWE-79

Description

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3, contain a stored Cross-Site Scripting (XSS) vulnerability, where user-controlled data is rendered without proper HTML escaping. An authenticated user with permission to set the relevant data can inject JavaScript that executes when another RT user views the affected page. This issue has been fixed in version 6.0.3.

Affected products

• Best Practical Request Tracker: from 6.0.0 before 6.0.3 — fixed in 6.0.3

How to fix

Upgrade to a fixed version: Best Practical Request Tracker 6.0.3. Check the vendor advisory for mitigations.

References

• https://github.com/bestpractical/rt/releases/tag/rt-6.0.3
• https://github.com/bestpractical/rt/security/advisories/GHSA-pfgp-5j8g-phgc

Get alerted when CVE-2026-44228 or the next vulnerability affects your stack