What’s Vulnerable › Vulnerabilities

CVE-2026-44229: RT: Cross-Site Scripting via inline-served uploaded content

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-20 · updated 2026-10-24
• Weakness: CWE-79

Description

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting (XSS) vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload content can include JavaScript in the upload that will execute in the browser session of any RT user who later views or downloads it. This issue has been fixed in versions 5.0.10 and 6.0.3.

Affected products

• Best Practical Request Tracker: from 5.0.0 before 5.0.10; from 6.0.0 before 6.0.3 — fixed in 5.0.10, 6.0.3

How to fix

Upgrade to a fixed version: Best Practical Request Tracker 5.0.10, 6.0.3. Check the vendor advisory for mitigations.

References

• https://github.com/bestpractical/rt/releases/tag/rt-6.0.3
• https://github.com/bestpractical/rt/security/advisories/GHSA-x576-pvwp-c2qv

Get alerted when CVE-2026-44229 or the next vulnerability affects your stack