Vulnerability Description
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting (XSS) vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload content can include JavaScript in the upload that will execute in the browser session of any RT user who later views or downloads it. This issue has been fixed in versions 5.0.10 and 6.0.3.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bestpractical | Request Tracker | >= 5.0.0, < 5.0.10 |
Related Weaknesses (CWE)
References
- https://github.com/bestpractical/rt/releases/tag/rt-6.0.3Release Notes
- https://github.com/bestpractical/rt/security/advisories/GHSA-x576-pvwp-c2qvVendor Advisory
FAQ
What is CVE-2026-44229?
CVE-2026-44229 is a vulnerability with a CVSS score of 5.4 (MEDIUM). RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting (XSS) vulnerability where upl...
How severe is CVE-2026-44229?
CVE-2026-44229 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-44229?
Check the references section above for vendor advisories and patch information. Affected products include: Bestpractical Request Tracker.