CVE-2026-44228: medium-severity vulnerability in bestpractical rt
RT: Stored Cross-Site Scripting via insufficient template escaping
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.4epss 0.3%
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3, contain a stored Cross-Site Scripting (XSS) vulnerability, where user-controlled data is rendered without proper HTML escaping. An authenticated user with permission to set the relevant data can inject JavaScript that executes when another RT user views the affected page. This issue has been fixed in version 6.0.3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected products
bestpractical · rtRelated CVEs — bestpractical rt
In the same product, most dangerous first.
CVE-2026-41076HIGHRT: LDAP authentication bypass via empty passwordEPSS 0.4%CVE-2026-41075HIGHRT: SQL injection via entry_aggregator parameter in JSON searchEPSS 0.3%CVE-2026-44227MEDIUMRT: Reflected Cross-Site Scripting via URL parametersEPSS 0.3%CVE-2026-44231CRITICALRT: Privilege escalation and information disclosure via REST 2.0 user collection endpointEPSS 0.2%CVE-2026-41073MEDIUMRT: Spreadsheet downloads vulnerable to CSV/formula injection in Microsoft Excel and similar appsEPSS 0.2%CVE-2026-44230MEDIUMRT: Reflected Cross-Site Scripting in search results chartEPSS 0.2%