CVE-2026-44229
RT: Cross-Site Scripting via inline-served uploaded content
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting (XSS) vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload content can include JavaScript in the upload that will execute in the browser session of any RT user who later views or downloads it. This issue has been fixed in versions 5.0.10 and 6.0.3.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
RT: Cross-Site Scripting via inline-served uploaded content
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting (XSS) vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload content can include JavaScript in the upload that will execute in the browser session of any RT user who later views or downloads it. This issue has been fixed in versions 5.0.10 and 6.0.3.
- Record
CVE-2026-44229- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2026-46078
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting (XSS) vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload content can include JavaScript in the upload that will execute in the browser session of any RT user who later views or downloads it. This issue has been fixed in versions 5.0.10 and 6.0.3.
- Record
EUVD-2026-46078- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
NVD
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting (XSS) vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload content can include JavaScript in the upload that will execute in the browser session of any RT user who later views or downloads it. This issue has been fixed in versions 5.0.10 and 6.0.3.
- Record
CVE-2026-44229- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
RT: Cross-Site Scripting via inline-served uploaded content
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting (XSS) vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload content can include JavaScript in the upload that will execute in the browser session of any RT user who later views or downloads it. This issue has been fixed in versions 5.0.10 and 6.0.3.
- Record
CVE-2026-44229- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-44229
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting (XSS) vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload content can include JavaScript in the upload that will execute in the browser session of any RT user who later views or downloads it. This issue has been fixed in versions 5.0.10 and 6.0.3.
- Record
DEBIAN-CVE-2026-44229- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-44229
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting (XSS) vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload content can include JavaScript in the upload that will execute in the browser session of any RT user who later views or downloads it. This issue has been fixed in versions 5.0.10 and 6.0.3.
- Record
UBUNTU-CVE-2026-44229- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
request-tracker4Debian:12 |
before 4.4.6+dfsg-1.1+deb12u4, plus listed versions 4.4.6+dfsg-1.14.4.6+dfsg-1.1+deb12u14.4.6+dfsg-1.1+deb12u24.4.6+dfsg-1.1+deb12u3 |
4.4.6+dfsg-1.1+deb12u4 |
request-tracker5Debian:12 |
before 5.0.3+dfsg-3~deb12u6, plus listed versions 5.0.3+dfsg-25.0.3+dfsg-3~deb12u15.0.3+dfsg-3~deb12u25.0.3+dfsg-3~deb12u35.0.3+dfsg-3~deb12u45.0.3+dfsg-3~deb12u5 |
5.0.3+dfsg-3~deb12u6 |
request-tracker5Debian:13 |
before 5.0.7+dfsg-4+deb13u3, plus listed versions 5.0.7+dfsg-45.0.7+dfsg-4+deb13u15.0.7+dfsg-4+deb13u2 |
5.0.7+dfsg-4+deb13u3 |
request-tracker5Debian:14 |
before 5.0.10+dfsg-1, plus listed versions 5.0.7+dfsg-45.0.7+dfsg-55.0.7+dfsg-65.0.9+dfsg-15.0.9+dfsg-25.0.9+dfsg-35.0.9+dfsg-4 |
5.0.10+dfsg-1 |
request-tracker4Ubuntu:16.04:LTS |
All versions, plus listed versions 4.2.11-24.2.12-34.2.12-44.2.12-5 |
None known |
request-tracker4Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 4.4.1-54.4.2-14.4.2-24.4.2-2ubuntu0.1~esm1 |
None known |
request-tracker4Ubuntu:20.04:LTS |
All versions, plus listed versions 4.4.3-24.4.3-2+deb10u3build0.20.04.1 |
None known |
request-tracker4Ubuntu:22.04:LTS |
All versions, plus listed versions 4.4.4+dfsg-2ubuntu14.4.4+dfsg-2ubuntu1.22.04.1 |
None known |
request-tracker5Ubuntu:Pro:22.04:LTS |
before 5.0.1+dfsg-1ubuntu1+esm2, plus listed versions 5.0.1+dfsg-1ubuntu15.0.1+dfsg-1ubuntu1+esm1 |
5.0.1+dfsg-1ubuntu1+esm2 |
request-tracker4Ubuntu:24.04:LTS |
All versions, plus listed versions 4.4.4+dfsg-2ubuntu14.4.4+dfsg-2ubuntu24.4.7+dfsg-1 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
request-tracker5Ubuntu:Pro:24.04:LTS |
before 5.0.5+dfsg-2ubuntu0.1~esm2, plus listed versions 5.0.1+dfsg-1ubuntu15.0.5+dfsg-25.0.5+dfsg-2ubuntu0.1~esm1 |
5.0.5+dfsg-2ubuntu0.1~esm2 |
request-tracker4Ubuntu:25.10 |
All versions, plus listed versions 4.4.7+dfsg-4syncable1 |
None known |
request-tracker5Ubuntu:25.10 |
All versions, plus listed versions 5.0.7+dfsg-25.0.7+dfsg-35.0.7+dfsg-4 |
None known |
request-tracker4Ubuntu:26.04:LTS |
All versions, plus listed versions 4.4.7+dfsg-4syncable1 |
None known |
request-tracker5Ubuntu:Pro:26.04:LTS |
before 5.0.7+dfsg-6ubuntu0.1~esm1, plus listed versions 5.0.7+dfsg-45.0.7+dfsg-6 |
5.0.7+dfsg-6ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-44229 is a medium vulnerability (CVSS 5.4) in Bestpractical Rt, published May 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 3rd percentile. Fixed in request-tracker4 4.4.6+dfsg-1.1+deb12u4.
References
github.com/bestpractical/rt/security/advisories/GHSA-x576-pvwp-c2qv
nvd.nist.gov/vuln/detail/CVE-2026-44229
security-tracker.debian.org/tracker/CVE-2026-44229
ubuntu.com/security/CVE-2026-44229
cve.org/CVERecord?id=CVE-2026-44229