Request Tracker XSS flaw affects versions 5.0.4–6.0.2
CERT Polska disclosed CVE-2026-6841, a reflected XSS vulnerability in Best Practical Request Tracker affecting versions 5.0.4–5.0.9 and 6.0.0–6.0.2.
CERT Polska has disclosed a reflected cross-site scripting (XSS) vulnerability in Best Practical Request Tracker, tracked as CVE-2026-6841. The flaw exists in the Page parameter of GET requests, allowing an attacker to craft malicious URLs that execute arbitrary JavaScript in a victim's browser when opened.
The vulnerability affects Request Tracker versions 5.0.4 through 5.0.9 and versions 6.0.0 through 6.0.2. Organizations running these versions should prioritize patching to mitigate the risk of session hijacking, credential theft, or other client-side attacks through socially-engineered links.
The vulnerability was discovered by Aleksander Iwicki from CERT Polska during independent research and disclosed through a coordinated vulnerability disclosure process.
Mentioned in this report
Detection guidance
Reflected XSS Attempt via Request Tracker Page Parameter
Detects HTTP GET requests containing script-injection patterns in the Page parameter, consistent with exploitation of CVE-2026-6841 in Best Practical Request Tracker. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Reflected XSS Attempt via Request Tracker Page Parameter
id: 88c72db8-fea4-5622-9e10-62925b121231
status: experimental
description: 'Detects HTTP requests to Request Tracker where the ''Page'' query parameter
contains typical
cross-site scripting payload markers (script tags, event handlers, javascript: URIs).
This matches exploitation attempts for CVE-2026-6841, a reflected XSS in the Page
parameter
affecting Request Tracker 5.0.4-5.0.9 and 6.0.0-6.0.2, where a crafted URL is opened
by a victim.
'
references:
- CVE-2026-6841
author: Vorant
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- Page=
xss_pattern:
cs-uri-query|contains:
- <script
- onerror=
- onload=
- 'javascript:'
- '%3Cscript'
- onmouseover=
- alert(
- document.cookie
condition: selection and xss_pattern
falsepositives:
- Security scanning tools or vulnerability assessments intentionally testing for XSS
- Automated web application fuzzers exercising the Page parameter with benign test
strings
level: medium
tags:
- attack.t1189
- cve.2026-6841
Suspicious Encoded Script Payload in Web Request Query String
Detects URL-encoded script injection sequences in query strings, a generic pattern for reflected XSS delivery links such as those exploiting the Request Tracker Page parameter flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Encoded Script Payload in Web Request Query String
id: 689ea63f-c43c-55ca-b315-8119b0f79d50
status: experimental
description: 'Detects URL-encoded HTML/JavaScript injection patterns (e.g. %3Cscript,
%3Csvg, onerror%3D) in
the query string of inbound web requests. Useful for catching socially-engineered
links sent to
victims that exploit reflected XSS such as CVE-2026-6841 in Request Tracker''s Page
parameter,
where payloads are typically URL-encoded to survive email/chat link sharing.
'
references:
- CVE-2026-6841
author: Vorant
logsource:
category: proxy
detection:
selection:
c-uri|contains:
- '%3Cscript'
- '%3Csvg'
- onerror%3D
- javascript%3A
- '%3Ciframe'
condition: selection
falsepositives:
- Penetration testing or bug bounty XSS scanning traffic
- Security tooling that crawls and tests web applications for injection flaws
level: low
tags:
- attack.t1189
- cve.2026-6841
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-6841
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free