CVE-2026-41076

RT versions 5.0.4-5.0.9 and 6.0.0-6.0.2 contain a reflected XSS vulnerability. An attacker can trick an authenticated user into visiting a crafted URL, executing arbitrary JavaScript in their session.

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting (XSS) vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload content can include JavaScript in the upload that will execute in the browser session of any RT user who later views or downloads it.

RT (Request Tracker) versions 6.0.0 through 6.0.2 contain a stored XSS vulnerability. An authenticated user with appropriate permissions can inject JavaScript that executes when another user views the page.

RT (ticket tracking system) versions 6.0.0 through 6.0.2 contain a reflected XSS vulnerability. An attacker can trick an authenticated user into visiting a crafted URL, allowing arbitrary JavaScript execution in the victim's session.

RT, an open-source issue and ticket tracking system, versions 5.0.0 through 5.0.9 and 6.0.0 through 6.0.2, contains an SQL injection vulnerability. An authenticated user can craft input that is incorporated into database queries without proper validation, potentially allowing them to read or modify data in the RT database.

RT versions 6.0.0 through 6.0.2 contain a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can induce a logged-in RT user to visit a malicious web page, triggering arbitrary state-changing actions in RT on that user's behalf.