# XSS Flaws Patched in Request Tracker, RTIR

Published: 2026-10-30 · Severity: routine · Sectors: Technology
Canonical: https://vorant.io/reports/83aea9be-3ebb-56a3-a2dc-53afa59c89ce/xss-flaws-patched-in-request-tracker-rtir
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> Three stored XSS bugs in Request Tracker and RT for Incident Response let unauthenticated emailers hijack handler sessions; fixed in 5.0.11 and 6.0.4.

Source: cert.pl — https://cert.pl/en/posts/2026/10/CVE-2026-105454

## What to check

- Applies to: The 3 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT Polska researcher Mateusz Szymaniec identified three cross-site scripting vulnerabilities affecting Best Practical Solutions' Request Tracker (RT) and RT for Incident Response (RTIR), a widely used open-source ticketing/incident-handling platform. All three stem from improper HTML escaping of attacker-controlled input (CWE-79) and allow stored XSS to be planted via ticket content, subjects, or links.

CVE-2026-105454 affects RT's automatic URL-to-link conversion, which fails to escape URLs embedded in HTML ticket content, allowing a crafted URL to break out and inject a script that executes when ticket history is viewed — no interaction required beyond viewing. Because many public-facing queues grant CreateTicket/ReplyToTicket to unauthenticated senders, an attacker can plant this via email alone. CVE-2026-105455 affects RTIR's ticket-splitting and incident-creation forms, which render related ticket subjects without escaping; since RTIR allows anyone to create Incident Reports by default, an emailed report with a malicious subject can execute script in the session of the staff member who processes it. CVE-2026-105456 is a flaw in RTIR's extension to RT's HTML scrubber, which over-permissively allows any link containing an internal placeholder — including javascript: scheme links — and this weakened filtering applies instance-wide once RTIR is installed, not just to RTIR queues.

In all cases, injected script executes in the victim user's authenticated RT session, letting an attacker act with that user's privileges (e.g., an incident handler or admin), raising risk of privilege escalation and lateral action within the ticketing system. No in-the-wild exploitation is reported; this was discovered through CERT Polska's own research and coordinated disclosure. Defenders should upgrade to RT 5.0.11/6.0.4 and RTIR 6.0.4 as applicable, and review queue permissions (CreateTicket, ReplyToTicket, Incident Report creation) that allow unauthenticated public submission.

## Mentioned in this report

- Vulnerabilities: CVE-2026-105454, CVE-2026-105455, CVE-2026-105456

## Detection guidance (public sample)

### XSS Payload in Request Tracker / RTIR Request Parameters

ATT&CK: T1059.007

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs webserver logs. Status: experimental. Generated from the report; not run against telemetry.

Detects script or javascript: payloads in query strings sent to RT/RTIR ticket and incident pages, consistent with stored-XSS planting or testing against the escaping flaws in RT and RTIR. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: XSS Payload in Request Tracker / RTIR Request Parameters
description: 'Detects script tags, javascript: scheme links or inline event handlers
  in query strings sent to RT/RTIR ticket and incident pages (ticket create/update,
  RTIR incident creation and splitting). Consistent with stored-XSS planting or probing
  for the unescaped subject, URL-linkification and scrubber flaws. Email-delivered
  payloads are not visible here, only web-submitted ones.'
tags:
- attack.execution
- attack.t1059.007
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains:
    - /RTIR/
    - /Ticket/Create.html
    - /Ticket/Update.html
    - /Ticket/Display.html
  selection_payload:
    cs-uri-query|contains:
    - <script
    - '%3cscript'
    - 'javascript:'
    - javascript%3a
    - onerror=
    - onload=
  condition: selection_path and selection_payload
falsepositives:
- Security scanners or authorised penetration tests against the RT instance
- Staff pasting code snippets into ticket subject fields submitted via GET parameters
level: medium
id: 32304840-3d9c-5856-81e8-3f499da2e779
status: experimental
author: Vorant
references:
- https://cert.pl/en/posts/2026/10/CVE-2026-105454
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/10/CVE-2026-105454

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/83aea9be-3ebb-56a3-a2dc-53afa59c89ce/xss-flaws-patched-in-request-tracker-rtir.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup