CVE-2026-44229CWE-79cross-site-scripting

CVE-2026-44229

Medium · published July 21, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
14.3
In the wild
Unconfirmed
What it is

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting (XSS) vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload content can include JavaScript in the upload that will execute in the browser session of any RT user who later views or downloads it. This issue has been fixed in versions 5.0.10 and 6.0.3.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00240 · 14.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-07-21T00:16Z
Affected products (2)
ProductVersionsFixed in
bestpractical/request_tracker≥ 5.0.0, < 5.0.105.0.10
bestpractical/request_tracker≥ 6.0.0, < 6.0.36.0.3
References (2)
https://github.com/bestpractical/rt/releases/tag/rt-6.0.3 · [email protected]https://github.com/bestpractical/rt/security/advisories/GHSA-x576-pvwp-c2qv · [email protected]
EPSS history
Timeline
  • 20 JUL 19:18Z
    RT: Cross-Site Scripting via inline-served uploaded content
    cvelistv5