Medium severity · published May 21, 2026
CVE-2026-6841
Reflected XSS in Request Tracker
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
Request Tracker is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the "Page" parameter in GET requests. An attacker can craft a URL that, when opened, results in arbitrary JavaScript execution in the victim’s browser.
This vulnerability affects versions from 5.0.4 up to 5.0.9 and from 6.0.0 up to 6.0.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RT
Request Tracker · Best Practical
5.0.4 before 5.0.10; 6.0.0 before 6.0.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-6841
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-6841
Third Party Advisory
https://cert.pl/en/posts/2026/05/CVE-2026-6841
Release Notes
https://docs.bestpractical.com/release-notes/rt/5.0.10
Release Notes
https://docs.bestpractical.com/release-notes/rt/6.0.3
Product
https://requesttracker.com/request-tracker/
More from Request Tracker
5.3
CVE-2025-9158
Stored XSS in Request Tracker