CVE-2026-44229: medium-severity vulnerability in bestpractical rt
RT: Cross-Site Scripting via inline-served uploaded content
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.4epss 0.1%
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting (XSS) vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload content can include JavaScript in the upload that will execute in the browser session of any RT user who later views or downloads it. This issue has been fixed in versions 5.0.10 and 6.0.3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected products
bestpractical · rtRelated CVEs — bestpractical rt
In the same product, most dangerous first.
CVE-2026-41076HIGHRT: LDAP authentication bypass via empty passwordEPSS 0.4%CVE-2026-41075HIGHRT: SQL injection via entry_aggregator parameter in JSON searchEPSS 0.3%CVE-2026-44227MEDIUMRT: Reflected Cross-Site Scripting via URL parametersEPSS 0.3%CVE-2026-44228MEDIUMRT: Stored Cross-Site Scripting via insufficient template escapingEPSS 0.3%CVE-2026-44231CRITICALRT: Privilege escalation and information disclosure via REST 2.0 user collection endpointEPSS 0.2%CVE-2026-41073MEDIUMRT: Spreadsheet downloads vulnerable to CSV/formula injection in Microsoft Excel and similar appsEPSS 0.2%