VulnerabilityAnalyzed

CVE-2026-44228

Versions 6.0.0 and above, prior to 6.0.3, contain a stored Cross-Site Scripting (XSS) vulnerability, where user-controlled data is rendered without proper HTML escaping.

MEDIUM 5.4EPSS 0.26%

Does this matter?

Lower severity and a low EPSS score (0.26%). Track it; it rarely justifies an emergency change on its own.

Description

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3, contain a stored Cross-Site Scripting (XSS) vulnerability, where user-controlled data is rendered without proper HTML escaping. An authenticated user with permission to set the relevant data can inject JavaScript that executes when another RT user views the affected page. This issue has been fixed in version 6.0.3.

CVSS 3.1: 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.26% probability · 17th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: bestpractical/request tracker
Source: security-advisories@github.com

References

https://github.com/bestpractical/rt/releases/tag/rt-6.0.3Release Notes
https://github.com/bestpractical/rt/security/advisories/GHSA-pfgp-5j8g-phgcVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.