CVE-2026-44228 in bestpractical
Summary
by MITRE • 07/20/2026
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3, contain a stored Cross-Site Scripting (XSS) vulnerability, where user-controlled data is rendered without proper HTML escaping. An authenticated user with permission to set the relevant data can inject JavaScript that executes when another RT user views the affected page. This issue has been fixed in version 6.0.3.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/20/2026
The RT (Request Tracker) system represents a widely deployed enterprise-grade ticketing solution that manages issue tracking workflows across numerous organizations. This particular vulnerability affects versions 6.0.0 through 6.0.2, where the application fails to properly sanitize user input before rendering it in web interfaces. The flaw exists within the data processing pipeline that handles user-controlled information submitted through various administrative and user-facing forms. When authenticated users with appropriate permissions submit malicious payloads containing javascript code, the system stores this data without adequate HTML escaping mechanisms. This stored data then gets rendered on subsequent page views without proper sanitization, creating a classic stored cross-site scripting vulnerability.
The technical implementation of this vulnerability stems from insufficient input validation and output encoding practices within the RT application's rendering engine. When user data flows through the application's processing layers, it bypasses proper HTML escaping routines that should occur before any content is presented to end users. The vulnerability specifically impacts scenarios where users can set attributes or descriptions containing potentially malicious code. An attacker exploiting this weakness needs only authentication privileges to a relevant role within RT, which typically includes administrative or user management permissions. Once the malicious payload is stored in the system, it executes automatically whenever other authenticated users navigate to pages displaying the compromised data, making this a particularly dangerous vulnerability for enterprise environments where multiple users interact with shared ticketing systems.
The operational impact of this vulnerability extends beyond simple script execution, as it enables attackers to potentially escalate privileges, steal session cookies, perform actions on behalf of legitimate users, or exfiltrate sensitive information from the ticketing system. The stored nature of this XSS vulnerability means that even if a user who submitted the malicious content leaves the system, other users continue to be exposed each time they view affected pages. This creates a persistent threat vector that remains active until the vulnerability is patched and the malicious data is removed from the database. Organizations using RT versions 6.0.0 through 6.0.2 face significant risk of unauthorized access, data compromise, and potential lateral movement within their network infrastructure through this vulnerable component.
Security practitioners should immediately update to RT version 6.0.3 or later to remediate this vulnerability, which addresses the root cause by implementing proper HTML escaping mechanisms in all user-input rendering paths. Additional mitigations include implementing strict input validation policies, employing content security policies to limit script execution, and conducting regular security assessments of web applications. This vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws, and maps to ATT&CK technique T1566 related to phishing attacks through compromised applications. Organizations should also consider implementing web application firewalls to detect and block malicious payloads, while conducting thorough code reviews to ensure similar vulnerabilities do not exist in other components of their ticketing infrastructure. The patch addresses the core issue by ensuring that all user-controllable data undergoes proper HTML escaping before presentation, preventing JavaScript execution within the context of legitimate user sessions.