Medium severity · published Jul 20, 2026
CVE-2026-44229
RT: Cross-Site Scripting via inline-served uploaded content
5.4
CVSS
0.1%
EPSS
No
On KEV
Description
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting (XSS) vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload content can include JavaScript in the upload that will execute in the browser session of any RT user who later views or downloads it. This issue has been fixed in versions 5.0.10 and 6.0.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RT
rt · bestpractical
>= 6.0.0, < 6.0.3; >= 5.0.0, < 5.0.10 · source: vendor
RT
Request Tracker · Bestpractical
5.0.0 before 5.0.10; 6.0.0 before 6.0.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-44229
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-44229
Release Notes
https://github.com/bestpractical/rt/releases/tag/rt-6.0.3
Vendor Advisory
https://github.com/bestpractical/rt/security/advisories/GHSA-x576-pvwp-c2qv
More from rt
9.1
CVE-2026-44231
RT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint
8.8
CVE-2026-41075
RT: SQL injection via entry_aggregator parameter in JSON search
8.1
CVE-2026-41076
RT: LDAP authentication bypass via empty password
7.1
CVE-2026-41074
RT has broken CSRF protection for authenticated users
6.1
CVE-2026-44230
RT: Reflected Cross-Site Scripting in search results chart