Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-105454— Stored XSS via crafted URLs in HTML ticket content in Request Tracker

Quick assessment

Affected
Best Practical Solutions Request Tracker
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

RT 在 HTML 工单内容中自动为 URL 创建链接时，未对链接中的 URL 进行 HTML 转义。攻击者可构造特殊 URL，使其“跳出”链接地址字段，从而注入一段脚本；当工单历史记录被查看时，该脚本将自动执行，无需用户进行任何额外操作。 任何有权在工单中添加 HTML 内容的用户均可植入此类脚本。这包括未经验证的发件人，只要其向某个队列发送 HTML 格式的电子邮件，而该队列允许“所有人”执行 CreateTicket 或 ReplyToTicket 操作（这在接受公众邮件的队列中非常常见）。该脚本将在查看该工

CVSS 5.3 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-105454

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Stored XSS via crafted URLs in HTML ticket content in Request Tracker
Source: CVE Program / CVE List V5
Vulnerability Description
RT's automatic link creation for URLs in HTML ticket content does not HTML-escape the URL it places in the link. A URL crafted to break out of the link's address can add a script that runs when the ticket history is displayed, with no further action by the viewer. Anyone who can add HTML content to a ticket can plant it. That includes an unauthenticated sender of HTML email to any queue that grants CreateTicket or ReplyToTicket to Everyone, which is routine for a queue that accepts mail from the public. The script runs in the session of any user who views the ticket, and can act in RT with that user's authority. This issue was fixed in version 5.0.11 and 6.0.4
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Best Practical Solutions Request Tracker 5.0.0 ~ 5.0.11 -

II. Public POCs for CVE-2026-105454

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-105454

请登录查看更多情报信息。

Other References for CVE-2026-105454 (1)

Same Patch Batch · Best Practical Solutions · 2026-10-30 · 3 CVEs total

CVE-2026-105455 5.3 MEDIUM Stored XSS via related ticket subject on RTIR Split and Create Incident forms
CVE-2026-105456 5.3 MEDIUM Stored XSS via HTML scrubber rule in RTIR

IV. Related Vulnerabilities

Same product: Request Tracker
Same vendor: Best Practical Solutions
Same weakness: CWE-79