CVE-2026-44229 Details
Description
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting (XSS) vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload content can include JavaScript in the upload that will execute in the browser session of any RT user who later views or downloads it. This issue has been fixed in versions 5.0.10 and 6.0.3.
A Cross-Site Scripting (XSS) vulnerability has been identified in RT, an open-source issue and ticket tracking system. This vulnerability affects RT versions 5.0.0 and 6.0.0 and above, prior to 5.0.10 and 6.0.3. The issue arises because uploaded content is delivered inline instead of as an attachment. An authenticated user with the ability to upload content can inject JavaScript into the upload, which will execute in the browser session of any RT user who subsequently views or downloads the content.
Users are advised to upgrade to RT versions 5.0.10 or 6.0.3. For those using RT 6.0.3, a patch is available that will be included in the upcoming RT 6.0.4 release. Additionally, consider restricting upload permissions to trusted users and enabling the 'AlwaysDownloadAttachments' configuration option to force downloads of uploaded content instead of rendering it inline.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/bestpractical/rt/releases/tag/rt-6.0.3 | [email protected] | Release Notes |
| https://github.com/bestpractical/rt/security/advisories/GHSA-x576-pvwp-c2qv | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| bestpractical request tracker | >= 5.0.0, < 5.0.10 >= 6.0.0, < 6.0.3 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 18, 2026 | Initial Analysis | [email protected] |
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 20, 2026 | New CVE Received | [email protected] |