XSS Flaws Patched in Request Tracker, RTIR
Three stored XSS bugs in Request Tracker and RT for Incident Response let unauthenticated emailers hijack handler sessions; fixed in 5.0.11 and 6.0.4.
Sourcecert.pl — open the original
What to check
- Applies to
- The 3 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska researcher Mateusz Szymaniec identified three cross-site scripting vulnerabilities affecting Best Practical Solutions' Request Tracker (RT) and RT for Incident Response (RTIR), a widely used open-source ticketing/incident-handling platform. All three stem from improper HTML escaping of attacker-controlled input (CWE-79) and allow stored XSS to be planted via ticket content, subjects, or links.
CVE-2026-105454 affects RT's automatic URL-to-link conversion, which fails to escape URLs embedded in HTML ticket content, allowing a crafted URL to break out and inject a script that executes when ticket history is viewed — no interaction required beyond viewing. Because many public-facing queues grant CreateTicket/ReplyToTicket to unauthenticated senders, an attacker can plant this via email alone. CVE-2026-105455 affects RTIR's ticket-splitting and incident-creation forms, which render related ticket subjects without escaping; since RTIR allows anyone to create Incident Reports by default, an emailed report with a malicious subject can execute script in the session of the staff member who processes it. CVE-2026-105456 is a flaw in RTIR's extension to RT's HTML scrubber, which over-permissively allows any link containing an internal placeholder — including javascript: scheme links — and this weakened filtering applies instance-wide once RTIR is installed, not just to RTIR queues.
In all cases, injected script executes in the victim user's authenticated RT session, letting an attacker act with that user's privileges (e.g., an incident handler or admin), raising risk of privilege escalation and lateral action within the ticketing system. No in-the-wild exploitation is reported; this was discovered through CERT Polska's own research and coordinated disclosure. Defenders should upgrade to RT 5.0.11/6.0.4 and RTIR 6.0.4 as applicable, and review queue permissions (CreateTicket, ReplyToTicket, Incident Report creation) that allow unauthenticated public submission.
Mentioned in this report
Detection guidance
XSS Payload in Request Tracker / RTIR Request Parameters
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects script or javascript: payloads in query strings sent to RT/RTIR ticket and incident pages, consistent with stored-XSS planting or testing against the escaping flaws in RT and RTIR. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: XSS Payload in Request Tracker / RTIR Request Parameters
description: 'Detects script tags, javascript: scheme links or inline event handlers
in query strings sent to RT/RTIR ticket and incident pages (ticket create/update,
RTIR incident creation and splitting). Consistent with stored-XSS planting or probing
for the unescaped subject, URL-linkification and scrubber flaws. Email-delivered
payloads are not visible here, only web-submitted ones.'
tags:
- attack.execution
- attack.t1059.007
logsource:
category: webserver
detection:
selection_path:
cs-uri-stem|contains:
- /RTIR/
- /Ticket/Create.html
- /Ticket/Update.html
- /Ticket/Display.html
selection_payload:
cs-uri-query|contains:
- <script
- '%3cscript'
- 'javascript:'
- javascript%3a
- onerror=
- onload=
condition: selection_path and selection_payload
falsepositives:
- Security scanners or authorised penetration tests against the RT instance
- Staff pasting code snippets into ticket subject fields submitted via GET parameters
level: medium
id: 32304840-3d9c-5856-81e8-3f499da2e779
status: experimental
author: Vorant
references:
- https://cert.pl/en/posts/2026/10/CVE-2026-105454
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/10/CVE-2026-105454
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs