CVE-2026-44227CWE-79cross-site-scripting

CVE-2026-44227

Medium · published July 20, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
17.1
In the wild
Unconfirmed
What it is

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting (XSS) vulnerability. An attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's browser session. There are no effective workarounds. Avoid following untrusted RT URLs. This issue has been fixed in version 6.0.3.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00263 · 17.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-07-20T22:16Z
Affected products (1)
ProductVersionsFixed in
bestpractical/request_tracker≥ 6.0.0, < 6.0.36.0.3
References (2)
https://github.com/bestpractical/rt/releases/tag/rt-6.0.3 · [email protected]https://github.com/bestpractical/rt/security/advisories/GHSA-7742-fhq7-ggv9 · [email protected]
EPSS history
Timeline
  • 20 JUL 17:32Z
    RT: Reflected Cross-Site Scripting via URL parameters
    cvelistv5