Vulnerability Description
Request Tracker is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the "Page" parameter in GET requests. An attacker can craft a URL that, when opened, results in arbitrary JavaScript execution in the victim’s browser. This vulnerability affects versions from 5.0.4 up to 5.0.9 and from 6.0.0 up to 6.0.2.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bestpractical | Request Tracker | >= 5.0.4, < 5.0.10 |
Related Weaknesses (CWE)
References
- https://cert.pl/en/posts/2026/05/CVE-2026-6841Third Party Advisory
- https://docs.bestpractical.com/release-notes/rt/5.0.10Release Notes
- https://docs.bestpractical.com/release-notes/rt/6.0.3Release Notes
- https://requesttracker.com/request-tracker/Product
FAQ
What is CVE-2026-6841?
CVE-2026-6841 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Request Tracker is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the "Page" parameter in GET requests. An attacker can craft a URL that, when opened, results in arbitrary Java...
How severe is CVE-2026-6841?
CVE-2026-6841 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-6841?
Check the references section above for vendor advisories and patch information. Affected products include: Bestpractical Request Tracker.