CVE-2026-44229 | RT is an open source, enterprise-grade issue and ticket trac… | CVSS 5.4 MEDIUM

Description

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting (XSS) vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload content can include JavaScript in the upload that will execute in the browser session of any RT user who later views or downloads it. This issue has been fixed in versions 5.0.10 and 6.0.3.

Metadata

CVE ID: CVE-2026-44229
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-05-05 15:42 UTC
Published: 2026-07-20 19:18 UTC
Last updated: 2026-07-20 19:18 UTC
Primary CWE: CWE-79
CWE-79: Improper Neutralization of Input During Web Page Gen…
Vendor / Product: bestpractical / rt
Sources: cve.org · NVD

Severity & Metrics

5.4 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected products (1)

Vendor	Product	Platform	Versions
bestpractical	rt	—	>= 6.0.0, < 6.0.3, >= 5.0.0, < 5.0.10

Weakness (CWE)

CWE	Source	Description
CWE-79	cna	CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS scores (1)

Score	Severity	Version	Source	Vector
5.4	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References (2)

https://github.com/bestpractical/rt/security/advisories/GHSA-x576-pvwp-c2qv https://github.com/bestpractical/rt/security/advisories/GHSA-x576-pvwp-c2qv
https://github.com/bestpractical/rt/releases/tag/rt-6.0.3 https://github.com/bestpractical/rt/releases/tag/rt-6.0.3