Best Practical Request Tracker reflected XSS vulnerability
CERT Polska disclosed CVE-2026-6841, a reflected XSS vulnerability in Best Practical Request Tracker versions 5.0.4-5.0.9 and 6.0.0-6.0.2 via the Page parameter.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska researcher Aleksander Iwicki discovered a reflected cross-site scripting (XSS) vulnerability in Best Practical Request Tracker, a widely-used ticketing and incident response system. The vulnerability, tracked as CVE-2026-6841, allows an attacker to craft malicious URLs containing JavaScript payloads in the Page parameter of GET requests. When a victim opens such a URL, arbitrary JavaScript executes in their browser context, potentially enabling session hijacking, credential theft, or other client-side attacks.
The vulnerability affects Request Tracker versions 5.0.4 through 5.0.9 and 6.0.0 through 6.0.2. CERT Polska participated in coordinated disclosure of this issue with the vendor. Organizations running affected versions should prioritize patching, as XSS vulnerabilities in ticketing systems can be leveraged in social engineering campaigns targeting IT and security teams who routinely handle external links.
No evidence of active exploitation has been reported at this time. The discovery underscores the value of independent security research and coordinated vulnerability disclosure programs in identifying and remediating security issues before they can be weaponized.
Mentioned in this report
Detection guidance
Possible Reflected XSS Attempt Against Request Tracker Page Parameter (CVE-2026-6841)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP GET requests to Request Tracker containing script-like payloads in the Page parameter, consistent with reflected XSS exploitation delivered via spearphishing links. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Possible Reflected XSS Attempt Against Request Tracker Page Parameter
id: 7f71e166-cebb-57a2-a742-0eae6c7a23dd
status: experimental
description: 'Detects HTTP GET requests targeting Best Practical Request Tracker where
the
''Page'' query parameter contains script tags, javascript: URIs, or event
handler payloads consistent with exploitation of CVE-2026-6841, a reflected
XSS vulnerability. Attackers typically deliver such crafted URLs via
spearphishing links or drive-by pages to IT/security staff who handle
ticketing links routinely.
'
references:
- https://cert.pl
author: Vorant
logsource:
category: webserver
detection:
selection_param:
cs-uri-query|contains: Page=
selection_payload:
cs-uri-query|contains:
- <script
- 'javascript:'
- onerror=
- onload=
- '%3Cscript'
- onmouseover=
condition: selection_param and selection_payload
falsepositives:
- Automated web application vulnerability scanners (e.g., Burp Suite, ZAP) testing
the RT instance
- Legitimate use of Page parameter containing encoded special characters that superficially
match patterns
level: medium
tags:
- attack.t1189
- attack.t1566.002
- cve.2026.6841
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-6841
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs