# Stored XSS in Request Tracker calendar invitations

Published: 2025-10-24 · Severity: routine
Canonical: https://vorant.io/reports/a861f974-63d1-5d3c-a224-63a313c661b9/stored-xss-in-request-tracker-calendar-invitations

> Stored XSS in Request Tracker calendar parsing allows JavaScript execution in user context via crafted email.

CERT Polska discovered a stored cross-site scripting vulnerability in Best Practical Request Tracker's calendar invitation parsing feature. The flaw exists because the software displays invitation data without HTML sanitization, allowing an attacker to send a specially crafted email that executes JavaScript code when a logged-in user views the ticket. This is a stored XSS—the malicious payload persists in the system and executes each time an authorized user accesses the affected ticket.

The vulnerability affects Request Tracker versions 5.0.4 through 5.0.8 and 6.0.0 through 6.0.1. Defenders running these versions should update immediately. The attacker needs only to send a crafted email to a Request Tracker instance; the malicious script runs in the victim's browser session, potentially allowing account takeover, data theft, or lateral movement within the RT instance. There is no public indication of active exploitation in the wild at the time of disclosure.

## Mentioned in this report

- Vulnerabilities: CVE-2025-9158

## Detection guidance (public sample)

### Script Injection Markers in Request Tracker Ticket or Helper Requests

ATT&CK: T1059.007

Detects script-injection markers in query strings sent to Request Tracker ticket, helper or REST endpoints, which can indicate XSS payloads or follow-on requests from injected JavaScript. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Script Injection Markers in Request Tracker Ticket or Helper Requests
description: Detects HTML/JavaScript injection markers in query strings sent to Request
  Tracker (RT) ticket, helper or REST endpoints. The stored XSS in calendar invitation
  parsing (RT 5.0.4-5.0.8, 6.0.0-6.0.1) is delivered by email and the payload itself
  is not visible in web logs. This rule only catches script markers that reach the
  web tier, for example requests made by injected JavaScript or probing of RT. Treat
  it as a hunting aid and combine it with patch-level checks.
tags:
- attack.execution
- attack.t1059.007
- attack.initial-access
- attack.t1189
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains:
    - /Ticket/
    - /Helpers/
    - /REST/
    - /Articles/
  selection_payload:
    cs-uri-query|contains:
    - <script
    - '%3Cscript'
    - 'javascript:'
    - onerror=
    - onload=
    - document.cookie
  condition: selection_path and selection_payload
falsepositives:
- Authorised web application security scanners testing the RT instance
- Users searching tickets for text that discusses JavaScript or HTML snippets
level: medium
id: 0bbd4933-57d2-5615-85ee-7f743fbbab22
status: experimental
author: Vorant
references:
- https://cert.pl/en/posts/2025/10/CVE-2025-9158
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2025/10/CVE-2025-9158

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a861f974-63d1-5d3c-a224-63a313c661b9/stored-xss-in-request-tracker-calendar-invitations.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup