Log in Start free

Vulnerability · Published Jul 20, 2026 · Assigned by GitHub_M

CVE-2026-44229RT: Cross-Site Scripting via inline-served uploaded content

Medium 5.4

In plain English

A medium-severity cross-site scripting in rt from bestpractical. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.1%top 96.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting (XSS) vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload content can include JavaScript in the upload that will execute in the browser session of any RT user who later views or downloads it. This issue has been fixed in versions 5.0.10 and 6.0.3.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12request-tracker44.4.6+dfsg-1.1+deb12u4DEBIAN-CVE-2026-44229
Debian:12request-tracker55.0.3+dfsg-3~deb12u6DEBIAN-CVE-2026-44229
Debian:13request-tracker55.0.7+dfsg-4+deb13u3DEBIAN-CVE-2026-44229
Debian:14request-tracker55.0.10+dfsg-1DEBIAN-CVE-2026-44229
Ubuntu:22.04:LTSrequest-tracker4no fix listedUBUNTU-CVE-2026-44229
Ubuntu:24.04:LTSrequest-tracker4no fix listedUBUNTU-CVE-2026-44229
Ubuntu:25.10request-tracker4no fix listedUBUNTU-CVE-2026-44229
Ubuntu:26.04:LTSrequest-tracker4no fix listedUBUNTU-CVE-2026-44229
Ubuntu:25.10request-tracker5no fix listedUBUNTU-CVE-2026-44229

Affected products (as reported)

VendorProductVersions
bestpractical rt >= 6.0.0, < 6.0.3>= 5.0.0, < 5.0.10

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References