CERT Polska discloses Request Tracker XSS flaw
A reflected XSS vulnerability in Best Practical Request Tracker (CVE-2026-6841) lets attackers run JavaScript in a victim's browser via a crafted URL.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska researcher Aleksander Iwicki discovered a reflected cross-site scripting vulnerability in Best Practical's Request Tracker, a widely used ticketing/helpdesk system, and coordinated its disclosure as CVE-2026-6841. The flaw resides in handling of the Page parameter in GET requests, allowing an attacker to craft a malicious URL that, when clicked by a victim, executes arbitrary JavaScript in the browser context of the logged-in user.
The vulnerability affects Request Tracker versions 5.0.4 through 5.0.9 and 6.0.0 through 6.0.2. As with typical reflected XSS issues, exploitation requires social engineering to get a target to click a crafted link, and impact is scoped to the victim's browser session (e.g., session hijacking, credential theft, or unauthorized actions within RT). No evidence of in-the-wild exploitation is mentioned in the disclosure; this appears to be a proactively identified and responsibly disclosed issue handled through CERT Polska's coordinated vulnerability disclosure process.
Organizations running affected Request Tracker versions should apply vendor patches once available and monitor Best Practical's advisories for remediation guidance.
Mentioned in this report
Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-6841
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs