Best Practical Solutions RT for Incident Response up to 6.0.3 Ticket Creation Forms cross site scripting

Summaryinfo

A vulnerability described as problematic has been identified in Best Practical Solutions RT for Incident Response up to 6.0.3. Affected by this issue is some unknown functionality of the component Ticket Creation Forms. The manipulation results in cross site scripting. This vulnerability is known as CVE-2026-105455. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic has been found in Best Practical Solutions RT for Incident Response up to 6.0.3. Affected is an unknown code block of the component Ticket Creation Forms. The manipulation with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. CVE summarizes:

RTIR's ticket creation forms show the subject of the related ticket when splitting a ticket or creating an incident from a report, and they render that subject without HTML escaping. A ticket subject containing script runs it when a user opens either form. RTIR grants everyone the right to create Incident Reports by default, so an unauthenticated sender of an emailed report can set that subject. The script then runs in the session of the incident handler who creates an incident from the report or splits it, and can act in RT with that user's authority.  The issue was fixed in version 6.0.4. RTIR 5.0 is not affected.

The advisory is available at cert.pl. This vulnerability is traded as CVE-2026-105455 since 10/05/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1059.007 by the MITRE ATT&CK project.

Upgrading to version 6.0.4 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Best Practical Solutions

Name

• RT for Incident Response

Version

• 6.0.0
• 6.0.1
• 6.0.2
• 6.0.3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion