CVE-2026-44227 | RT is an open source, enterprise-grade issue and ticket trac… | CVSS 6.1 MEDIUM

Description

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting (XSS) vulnerability. An attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's browser session. There are no effective workarounds. Avoid following untrusted RT URLs. This issue has been fixed in version 6.0.3.

Metadata

CVE ID: CVE-2026-44227
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-05-05 15:42 UTC
Published: 2026-07-20 17:32 UTC
Last updated: 2026-07-20 19:06 UTC
Primary CWE: CWE-79
CWE-79: Improper Neutralization of Input During Web Page Gen…
Vendor / Product: bestpractical / rt
Sources: cve.org · NVD

Severity & Metrics

6.1 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
bestpractical	rt	—	>= 6.0.0, < 6.0.3

Weakness (CWE)

CWE	Source	Description
CWE-79	cna	CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS scores (1)

Score	Severity	Version	Source	Vector
6.1	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References (2)

https://github.com/bestpractical/rt/security/advisories/GHSA-7742-fhq7-ggv9 https://github.com/bestpractical/rt/security/advisories/GHSA-7742-fhq7-ggv9
https://github.com/bestpractical/rt/releases/tag/rt-6.0.3 https://github.com/bestpractical/rt/releases/tag/rt-6.0.3