Cross-Site Scripting Vulnerability in RTIR by Best Practical Solutions
CVE-2026-105455

5.3MEDIUM

Key Information:

Vendor

Best Practical Solutions

Status
Rt For Incident Response
Vendor
CVE Published:
30 October 2026

What is CVE-2026-105455?

A cross-site scripting vulnerability exists in RTIR's ticket creation forms, where the subject of related tickets can be manipulated without HTML escaping. This allows an attacker to inject scripts when a user opens the ticket form. Since RTIR permits everyone to create Incident Reports by default, an unauthenticated user can set the subject in an emailed report. Consequently, when an incident handler splits a ticket or creates a new incident from the report, the malicious script executes in their session, potentially granting unauthorized access and control within the application.

Affected Version(s)

RT for Incident Response 6.0.0 < 6.0.4

References

https://cert.pl/en/posts/2026/10/CVE-2026-105454
third-party-advisory
https://requesttracker.com/rtir/
product

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mateusz Szymaniec (CERT.PL)
.