Search
Find a vulnerability
Search criteria
4 vulnerabilities found for RT for Incident Response by Best Practical Solutions
CVE-2026-105456 (GCVE-0-2026-105456)
Vulnerability from nvd – Published: 2026-10-30 15:22 – Updated: 2026-10-30 17:18 X_Open Source
VLAI
EPSS
VEX
Title
Stored XSS via HTML scrubber rule in RTIR
Summary
RTIR extends RT's HTML scrubber to allow an internal link
placeholder, and the extension lets through any link that merely
contains the placeholder, including links using the executable
javascript: scheme. The change applies to the whole RT instance
once RTIR is installed, not only to RTIR's own queues. Anyone who
can add HTML content to a ticket on such an instance can store
such a link. That includes an unauthenticated sender of HTML email
to the Incident Reports queue, which RTIR opens to everyone by
default. Script runs when a user clicks the link, in that user's
session, and can act in RT with that user's authority.
This issue was fixed in version 5.0.11 and 6.0.4
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 17:05 UTC
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://cert.pl/en/posts/2026/10/CVE-2026-105454 | third-party-advisory |
| https://requesttracker.com/rtir/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Best Practical Solutions | RT for Incident Response |
Affected:
5.0.0 , < 5.0.11
(semver)
Affected: 6.0.0 , < 6.0.4 (semver) cpe:2.3:a:best_practical_solutions:rt_for_incident_response:*:*:*:*:*:*:*:* cpe:2.3:a:best_practical_solutions:rt_for_incident_response:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105456",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T17:05:31.942517Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T17:18:22.375Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RT for Incident Response",
"repo": "https://github.com/bestpractical/rtir",
"vendor": "Best Practical Solutions",
"versions": [
{
"lessThan": "5.0.11",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
},
{
"lessThan": "6.0.4",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:best_practical_solutions:rt_for_incident_response:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.0.11",
"versionStartIncluding": "5.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:best_practical_solutions:rt_for_incident_response:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.4",
"versionStartIncluding": "6.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mateusz Szymaniec (CERT.PL)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "RTIR extends RT\u0027s HTML scrubber to allow an internal link\n placeholder, and the extension lets through any link that merely\n contains the placeholder, including links using the executable\n javascript: scheme. The change applies to the whole RT instance\n once RTIR is installed, not only to RTIR\u0027s own queues. Anyone who\n can add HTML content to a ticket on such an instance can store\n such a link. That includes an unauthenticated sender of HTML email\n to the Incident Reports queue, which RTIR opens to everyone by\n default. Script runs when a user clicks the link, in that user\u0027s\n session, and can act in RT with that user\u0027s authority.\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eThis issue was fixed in version\u0026nbsp;5.0.11 and 6.0.4\u003c/div\u003e"
}
],
"value": "RTIR extends RT\u0027s HTML scrubber to allow an internal link\n placeholder, and the extension lets through any link that merely\n contains the placeholder, including links using the executable\n javascript: scheme. The change applies to the whole RT instance\n once RTIR is installed, not only to RTIR\u0027s own queues. Anyone who\n can add HTML content to a ticket on such an instance can store\n such a link. That includes an unauthenticated sender of HTML email\n to the Incident Reports queue, which RTIR opens to everyone by\n default. Script runs when a user clicks the link, in that user\u0027s\n session, and can act in RT with that user\u0027s authority.\n\n\nThis issue was fixed in version\u00a05.0.11 and 6.0.4"
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-592 Stored XSS"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:22:07.644Z",
"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"shortName": "CERT-PL"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://cert.pl/en/posts/2026/10/CVE-2026-105454"
},
{
"tags": [
"product"
],
"url": "https://requesttracker.com/rtir/"
}
],
"source": {
"discovery": "INTERNAL"
},
"tags": [
"x_open-source"
],
"title": "Stored XSS via HTML scrubber rule in RTIR",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"assignerShortName": "CERT-PL",
"cveId": "CVE-2026-105456",
"datePublished": "2026-10-30T15:22:07.644Z",
"dateReserved": "2026-10-05T14:00:11.458Z",
"dateUpdated": "2026-10-30T17:18:22.375Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105455 (GCVE-0-2026-105455)
Vulnerability from nvd – Published: 2026-10-30 15:34 – Updated: 2026-10-30 17:18 X_Open Source
VLAI
EPSS
VEX
Title
Stored XSS via related ticket subject on RTIR Split and Create Incident forms
Summary
RTIR's ticket creation forms show the subject of the related
ticket when splitting a ticket or creating an incident from a
report, and they render that subject without HTML escaping. A
ticket subject containing script runs it when a user opens either
form. RTIR grants everyone the right to create Incident Reports by
default, so an unauthenticated sender of an emailed report can set
that subject. The script then runs in the session of the incident
handler who creates an incident from the report or splits it, and
can act in RT with that user's authority.
The issue was fixed in version 6.0.4. RTIR 5.0 is not
affected.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 17:05 UTC
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://cert.pl/en/posts/2026/10/CVE-2026-105454 | third-party-advisory |
| https://requesttracker.com/rtir/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Best Practical Solutions | RT for Incident Response |
Affected:
6.0.0 , < 6.0.4
(semver)
cpe:2.3:a:best_practical_solutions:rt_for_incident_response:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105455",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T17:05:42.052215Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T17:18:22.098Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RT for Incident Response",
"repo": "https://github.com/bestpractical/rtir",
"vendor": "Best Practical Solutions",
"versions": [
{
"lessThan": "6.0.4",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:best_practical_solutions:rt_for_incident_response:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.4",
"versionStartIncluding": "6.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mateusz Szymaniec (CERT.PL)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "RTIR\u0027s ticket creation forms show the subject of the related\n ticket when splitting a ticket or creating an incident from a\n report, and they render that subject without HTML escaping. A\n ticket subject containing script runs it when a user opens either\n form. RTIR grants everyone the right to create Incident Reports by\n default, so an unauthenticated sender of an emailed report can set\n that subject. The script then runs in the session of the incident\n handler who creates an incident from the report or splits it, and\n can act in RT with that user\u0027s authority.\u0026nbsp;\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eThe issue was fixed in version 6.0.4. RTIR 5.0 is not\n affected.\u003c/div\u003e"
}
],
"value": "RTIR\u0027s ticket creation forms show the subject of the related\n ticket when splitting a ticket or creating an incident from a\n report, and they render that subject without HTML escaping. A\n ticket subject containing script runs it when a user opens either\n form. RTIR grants everyone the right to create Incident Reports by\n default, so an unauthenticated sender of an emailed report can set\n that subject. The script then runs in the session of the incident\n handler who creates an incident from the report or splits it, and\n can act in RT with that user\u0027s authority.\u00a0\n\n\nThe issue was fixed in version 6.0.4. RTIR 5.0 is not\n affected."
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-592 Stored XSS"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:34:49.001Z",
"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"shortName": "CERT-PL"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://cert.pl/en/posts/2026/10/CVE-2026-105454"
},
{
"tags": [
"product"
],
"url": "https://requesttracker.com/rtir/"
}
],
"source": {
"discovery": "INTERNAL"
},
"tags": [
"x_open-source"
],
"title": "Stored XSS via related ticket subject on RTIR Split and Create Incident forms",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"assignerShortName": "CERT-PL",
"cveId": "CVE-2026-105455",
"datePublished": "2026-10-30T15:34:49.001Z",
"dateReserved": "2026-10-05T14:00:11.458Z",
"dateUpdated": "2026-10-30T17:18:22.098Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105455 (GCVE-0-2026-105455)
Vulnerability from cvelistv5 – Published: 2026-10-30 15:34 – Updated: 2026-10-30 17:18 X_Open Source
VLAI
EPSS
VEX
Title
Stored XSS via related ticket subject on RTIR Split and Create Incident forms
Summary
RTIR's ticket creation forms show the subject of the related
ticket when splitting a ticket or creating an incident from a
report, and they render that subject without HTML escaping. A
ticket subject containing script runs it when a user opens either
form. RTIR grants everyone the right to create Incident Reports by
default, so an unauthenticated sender of an emailed report can set
that subject. The script then runs in the session of the incident
handler who creates an incident from the report or splits it, and
can act in RT with that user's authority.
The issue was fixed in version 6.0.4. RTIR 5.0 is not
affected.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 17:05 UTC
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://cert.pl/en/posts/2026/10/CVE-2026-105454 | third-party-advisory |
| https://requesttracker.com/rtir/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Best Practical Solutions | RT for Incident Response |
Affected:
6.0.0 , < 6.0.4
(semver)
cpe:2.3:a:best_practical_solutions:rt_for_incident_response:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105455",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T17:05:42.052215Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T17:18:22.098Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RT for Incident Response",
"repo": "https://github.com/bestpractical/rtir",
"vendor": "Best Practical Solutions",
"versions": [
{
"lessThan": "6.0.4",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:best_practical_solutions:rt_for_incident_response:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.4",
"versionStartIncluding": "6.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mateusz Szymaniec (CERT.PL)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "RTIR\u0027s ticket creation forms show the subject of the related\n ticket when splitting a ticket or creating an incident from a\n report, and they render that subject without HTML escaping. A\n ticket subject containing script runs it when a user opens either\n form. RTIR grants everyone the right to create Incident Reports by\n default, so an unauthenticated sender of an emailed report can set\n that subject. The script then runs in the session of the incident\n handler who creates an incident from the report or splits it, and\n can act in RT with that user\u0027s authority.\u0026nbsp;\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eThe issue was fixed in version 6.0.4. RTIR 5.0 is not\n affected.\u003c/div\u003e"
}
],
"value": "RTIR\u0027s ticket creation forms show the subject of the related\n ticket when splitting a ticket or creating an incident from a\n report, and they render that subject without HTML escaping. A\n ticket subject containing script runs it when a user opens either\n form. RTIR grants everyone the right to create Incident Reports by\n default, so an unauthenticated sender of an emailed report can set\n that subject. The script then runs in the session of the incident\n handler who creates an incident from the report or splits it, and\n can act in RT with that user\u0027s authority.\u00a0\n\n\nThe issue was fixed in version 6.0.4. RTIR 5.0 is not\n affected."
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-592 Stored XSS"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:34:49.001Z",
"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"shortName": "CERT-PL"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://cert.pl/en/posts/2026/10/CVE-2026-105454"
},
{
"tags": [
"product"
],
"url": "https://requesttracker.com/rtir/"
}
],
"source": {
"discovery": "INTERNAL"
},
"tags": [
"x_open-source"
],
"title": "Stored XSS via related ticket subject on RTIR Split and Create Incident forms",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"assignerShortName": "CERT-PL",
"cveId": "CVE-2026-105455",
"datePublished": "2026-10-30T15:34:49.001Z",
"dateReserved": "2026-10-05T14:00:11.458Z",
"dateUpdated": "2026-10-30T17:18:22.098Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105456 (GCVE-0-2026-105456)
Vulnerability from cvelistv5 – Published: 2026-10-30 15:22 – Updated: 2026-10-30 17:18 X_Open Source
VLAI
EPSS
VEX
Title
Stored XSS via HTML scrubber rule in RTIR
Summary
RTIR extends RT's HTML scrubber to allow an internal link
placeholder, and the extension lets through any link that merely
contains the placeholder, including links using the executable
javascript: scheme. The change applies to the whole RT instance
once RTIR is installed, not only to RTIR's own queues. Anyone who
can add HTML content to a ticket on such an instance can store
such a link. That includes an unauthenticated sender of HTML email
to the Incident Reports queue, which RTIR opens to everyone by
default. Script runs when a user clicks the link, in that user's
session, and can act in RT with that user's authority.
This issue was fixed in version 5.0.11 and 6.0.4
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 17:05 UTC
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://cert.pl/en/posts/2026/10/CVE-2026-105454 | third-party-advisory |
| https://requesttracker.com/rtir/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Best Practical Solutions | RT for Incident Response |
Affected:
5.0.0 , < 5.0.11
(semver)
Affected: 6.0.0 , < 6.0.4 (semver) cpe:2.3:a:best_practical_solutions:rt_for_incident_response:*:*:*:*:*:*:*:* cpe:2.3:a:best_practical_solutions:rt_for_incident_response:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105456",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T17:05:31.942517Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T17:18:22.375Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RT for Incident Response",
"repo": "https://github.com/bestpractical/rtir",
"vendor": "Best Practical Solutions",
"versions": [
{
"lessThan": "5.0.11",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
},
{
"lessThan": "6.0.4",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:best_practical_solutions:rt_for_incident_response:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.0.11",
"versionStartIncluding": "5.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:best_practical_solutions:rt_for_incident_response:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.4",
"versionStartIncluding": "6.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mateusz Szymaniec (CERT.PL)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "RTIR extends RT\u0027s HTML scrubber to allow an internal link\n placeholder, and the extension lets through any link that merely\n contains the placeholder, including links using the executable\n javascript: scheme. The change applies to the whole RT instance\n once RTIR is installed, not only to RTIR\u0027s own queues. Anyone who\n can add HTML content to a ticket on such an instance can store\n such a link. That includes an unauthenticated sender of HTML email\n to the Incident Reports queue, which RTIR opens to everyone by\n default. Script runs when a user clicks the link, in that user\u0027s\n session, and can act in RT with that user\u0027s authority.\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eThis issue was fixed in version\u0026nbsp;5.0.11 and 6.0.4\u003c/div\u003e"
}
],
"value": "RTIR extends RT\u0027s HTML scrubber to allow an internal link\n placeholder, and the extension lets through any link that merely\n contains the placeholder, including links using the executable\n javascript: scheme. The change applies to the whole RT instance\n once RTIR is installed, not only to RTIR\u0027s own queues. Anyone who\n can add HTML content to a ticket on such an instance can store\n such a link. That includes an unauthenticated sender of HTML email\n to the Incident Reports queue, which RTIR opens to everyone by\n default. Script runs when a user clicks the link, in that user\u0027s\n session, and can act in RT with that user\u0027s authority.\n\n\nThis issue was fixed in version\u00a05.0.11 and 6.0.4"
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-592 Stored XSS"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:22:07.644Z",
"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"shortName": "CERT-PL"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://cert.pl/en/posts/2026/10/CVE-2026-105454"
},
{
"tags": [
"product"
],
"url": "https://requesttracker.com/rtir/"
}
],
"source": {
"discovery": "INTERNAL"
},
"tags": [
"x_open-source"
],
"title": "Stored XSS via HTML scrubber rule in RTIR",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"assignerShortName": "CERT-PL",
"cveId": "CVE-2026-105456",
"datePublished": "2026-10-30T15:22:07.644Z",
"dateReserved": "2026-10-05T14:00:11.458Z",
"dateUpdated": "2026-10-30T17:18:22.375Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}