# Stored XSS vulnerabilities in Request Tracker and RT for Incident Response (CVE-2026-105454, CVE-2026-105455, CVE-2026-105456)

> CERT Polska disclosed three cross-site scripting (CWE-79) vulnerabilities in Best Practical's Request Tracker (RT) and RT for Incident Response (RTIR). They allow script injection through unescaped URL linkification in ticket history, unescaped related-ticket subjects in RTIR incident creation/splitting forms, and an RTIR HTML scrubber that permits javascript: links. Unauthenticated email senders can plant the payloads.

- **Published:** 2026-10-31T05:25:22Z
- **Last reviewed:** 2026-10-31T05:25:22Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4882
- **ID:** TL-2026-4882
- **Severity:** MEDIUM
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-105454, CVE-2026-105455, CVE-2026-105456, CVE-2026-6841

## Description

On 30 October 2026 CERT Polska published an advisory (credit: Mateusz Szymaniec, CERT Polska) covering three XSS flaws in products from Best Practical Solutions. All three are classified CWE-79. The advisory does not state a CVSS score, exploitation in the wild, or public PoC availability, so none are asserted here.

CVE-2026-105454 (Request Tracker 5.0.0-5.0.11 and 6.0.0-6.0.4): RT's automatic URL linkification in HTML ticket content does not HTML-escape URLs. A URL crafted to break out of the link's address attribute can add a script that runs when the ticket history is displayed, with no further action by the viewer. Unauthenticated senders can exploit it by sending HTML email to publicly accessible queues, because inbound email becomes ticket content viewed by staff. The RT 6.0.4 release notes describe it as stored XSS via URLs in HTML ticket content.

CVE-2026-105455 (RTIR 6.0.0-6.0.4; RTIR 5.0 is unaffected): the ticket creation forms for splitting and for incident creation display the subjects of related tickets without HTML escaping. A script in the ticket subject runs when a user opens either form, which can compromise the session of an incident handler. The RTIR 6.0.4 release notes state unauthenticated users can exploit it through email submissions.

CVE-2026-105456 (RTIR 5.0.0-5.0.11 and 6.0.0-6.0.4): RTIR's HTML scrubber extension permits links with javascript: schemes (including ones containing internal link placeholders). Anyone who can add HTML content to a ticket, including unauthenticated email senders to the Incident Reports queue, can store such a link; it executes upon user interaction.

Best Practical released RT 6.0.4 and RTIR 6.0.4 on 29 October 2026. The RT 6.0.4 notes list more than 20 security fixes (a fetch of the page reported 26; an earlier read reported 25), including several other reflected and stored XSS issues, a template-bypass remote code execution fix, an authorization bypass in ticket forwarding, and an unauthenticated denial of service. They recommend all users upgrade as soon as possible, and require updated dependencies (MIME::Tools 5.522, HTML::Gumbo 0.19, Starlet 0.33, Mozilla::CA 20261020). RTIR's notes say to upgrade RT to the matching 6.0.4 release alongside RTIR. No 5.0.x companion release notes were found; the advisory lists 5.0.11 as both within the affected range and a fixed version, so administrators should confirm the exact patched 5.0.x build with the vendor.

Because RT/RTIR are used by SOC/CSIRT teams, stored XSS delivered by inbound email targets incident-response staff in their ticket workflow. Severity MEDIUM is an analyst placeholder, not a source value. No network IOCs, malware, or threat actor are named in the sources.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1204.001 User Execution: Malicious Link
- T1185 Browser Session Hijacking
- T1539 Steal Web Session Cookie

## Sources

- [Vulnerabilities in Request Tracker and RT for Incident Response software (CERT Polska)](https://cert.pl/en/posts/2026/10/CVE-2026-105454/)
- [RT 6.0.4 Release Notes (Best Practical)](https://docs.bestpractical.com/release-notes/rt/6.0.4)
- [RTIR 6.0.4 Release Notes (Best Practical)](https://docs.bestpractical.com/release-notes/rtir/6.0.4)
- [RTIR 5.0.10 Release Notes (Best Practical, prior release)](https://docs.bestpractical.com/release-notes/rtir/5.0.10)
- [RTIR 6.0.3 Release Notes (Best Practical, prior release)](https://docs.bestpractical.com/release-notes/rtir/6.0.3)
- [CERT Polska Coordinated Vulnerability Disclosure policy](https://cert.pl/en/cvd/)
- [Best Practical - Request Tracker](https://bestpractical.com/request-tracker)
- [Best Practical - RT for Incident Response](https://bestpractical.com/rtir)
- [CWE-79: Improper Neutralization of Input During Web Page Generation (XSS)](https://cwe.mitre.org/data/definitions/79.html)
- [NVD - CVE-2026-6841 (earlier related Request Tracker XSS fixed in RT 6.0.3, context only)](https://nvd.nist.gov/vuln/detail/cve-2026-6841)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4882