Request Tracker 與 RT for Incident Response 軟體漏洞曝光
Vulnerabilities in Request Tracker and RT for Incident Response software
本次 CVE 暴露了 Request Tracker 與 RT for Incident Response 軟體的跨站指令碼 (XSS) 漏洞，可能允許未授權使用者在票務頁面注入惡意指令碼。
本次 CVE 暴露了 Request Tracker 與 RT for Incident Response 軟體的跨站指令碼漏洞，提醒使用者即時升級以避免跨站指令碼攻擊
Vulnerabilities in Request Tracker and RT for Incident Response software
| CVE ID | CVE-2026-105454 |
| Publication date | 30 October 2026 |
| Vendor | Best Practical Solutions |
| Product | Request Tracker |
| Vulnerable versions | From 5.0.0 to 5.0.11 From 6.0.0 to 6.0.4 |
| Vulnerability type (CWE) | Improper neutralization of input during web page generation ('cross-site scripting') (CWE-79) |
| Report source | Own research |
| CVE ID | CVE-2026-105455 |
| Publication date | 30 October 2026 |
| Vendor | Best Practical Solutions |
| Product | RT for Incident Response |
| Vulnerable versions | From 6.0.0 to 6.0.4 |
| Vulnerability type (CWE) | Improper neutralization of input during web page generation ('cross-site scripting') (CWE-79) |
| Report source | Own research |
| CVE ID | CVE-2026-105456 |
| Publication date | 30 October 2026 |
| Vendor | Best Practical Solutions |
| Product | RT for Incident Response |
| Vulnerable versions | From 5.0.0 to 5.0.11 From 6.0.0 to 6.0.4 |
| Vulnerability type (CWE) | Improper neutralization of input during web page generation ('cross-site scripting') (CWE-79) |
| Report source | Own research |
Description
Mateusz Szymaniec from CERT Polska discovered vulnerabilities in Request Tracker and RT for Incident Response software during his own research and participated in coordination of their disclosure.
The vulnerability CVE-2026-105454: RT's automatic link creation for URLs in HTML ticket content does not HTML-escape the URL it places in the link. A URL crafted to break out of the link's address can add a script that runs when the ticket history is displayed, with no further action by the viewer. Anyone who can add HTML content to a ticket can plant it. That includes an unauthenticated sender of HTML email to any queue that grants CreateTicket or ReplyToTicket to Everyone, which is common for a queue that accepts mails from the public. The script runs in a session of any user who views the ticket, and can act in RT with that user's authority.
This issue was fixed in version 5.0.11 and 6.0.4
The vulnerability CVE-2026-105455: RTIR's ticket creation forms show the subject of the related ticket when splitting a ticket or creating an incident from a report, and they render that subject without HTML escaping. A script in the ticket subject runs when a user opens either form. RTIR grants everyone the right to create Incident Reports by default, so an unauthenticated sender of an emailed report can set that subject. The script then runs in the session of the incident handler who creates an incident from the report or splits it, and can act in RT with that user's authority.
The issue was fixed in version 6.0.4. RTIR 5.0 is not affected.
The vulnerability CVE-2026-105456: RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only to RTIR's own queues. Anyone who can add HTML content to a ticket on such an instance can store such a link. That includes an unauthenticated sender of HTML email to the Incident Reports queue, which RTIR opens to everyone by default. Script runs when a user clicks the link, in that user's session, and can act in RT with that user's authority.
This issue was fixed in version 5.0.11 and 6.0.4
More about the coordinated vulnerability disclosure process at CERT Polska can be found at https://cert.pl/en/cvd/.