CVE-2026-105454 in Request Tracker
Summary
by MITRE • 10/30/2026
RT's automatic link creation for URLs in HTML ticket content does not HTML-escape the URL it places in the link. A URL crafted to break out of the link's address can add a script that runs when the ticket history is displayed, with no further action by the viewer. Anyone who can add HTML content to a ticket can plant it. That includes an unauthenticated sender of HTML email to any queue that grants CreateTicket or ReplyToTicket to Everyone, which is routine for a queue that accepts mail from the public. The script runs in the session of any user who views the ticket, and can act in RT with that user's authority.
This issue was fixed in version 5.0.11 and 6.0.4
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability described constitutes a stored cross-site scripting flaw within Request Tracker, specifically affecting how HTML content is processed during the automatic creation of hyperlinks from URLs embedded in ticket bodies. The core technical failure lies in the application's inability to properly sanitize or escape special characters when constructing anchor tags for detected URLs. Instead of encoding potentially dangerous entities such as angle brackets or quotation marks that could terminate the href attribute prematurely, the system inserts raw user-supplied input directly into the HTML structure. This lack of output encoding allows an attacker to inject malicious JavaScript code by crafting a URL string that breaks out of the intended link context and executes arbitrary scripts within the victim's browser session.
The operational impact is severe because this vulnerability enables persistent data injection rather than transient reflection. Once the malicious content is saved in the ticket history, it remains active until manually removed or the system is patched. Any user with permission to view the ticket will inadvertently execute the injected script upon loading the page. This execution occurs within the security context of the viewing user, meaning the attacker can perform actions on behalf of that user without their knowledge or consent. In environments where public-facing queues allow unauthenticated users to create tickets via email, this vulnerability provides a direct path for initial compromise by external actors who do not require valid credentials to plant the payload.
From an industry standards perspective, this flaw aligns with CWE-79, which classifies improper neutralization of input during web page generation as Cross-site Scripting. The attack vector leverages stored persistence mechanisms typical of CWE-614, allowing the malicious script to reside in the database and trigger repeatedly for multiple victims. In terms of adversary tactics, this aligns with MITRE ATT&CK techniques related to client-side code injection and potentially credential harvesting or session hijacking if the script exfiltrates cookies or performs actions like sending emails on behalf of the victim. The ability to act with the user's authority underscores the risk of privilege escalation within the application logic itself, as the malicious scripts can interact with RT APIs or UI elements just as a legitimate user would.
Mitigation strategies must prioritize immediate patching to version 5.0.11 or 6.0.4 where this issue was resolved through improved input validation and output encoding practices. Until patches are applied, administrators should restrict the ability of unauthenticated users to create tickets in queues that process HTML content. Implementing a strict Content Security Policy can also help mitigate the impact by preventing inline script execution, although relying solely on CSP is not sufficient given the persistent nature of stored XSS. Regular security audits and code reviews focusing on output encoding for all dynamic user inputs are essential to prevent similar vulnerabilities in other modules or future versions of the software.