HTML Scrubber Vulnerability in Request Tracker's Incident Reports by Best Practical Solutions

CVE-2026-105456

What is CVE-2026-105456?

The vulnerability allows an internal link placeholder in the HTML scrubber of Request Tracker's Incident Reports (RTIR) to be exploited, permitting any link containing a placeholder to execute JavaScript code. This can occur across the entire RT instance once RTIR is installed, impacting any user who can submit HTML content to tickets. Notably, unauthenticated users can exploit this by sending HTML emails to the Incident Reports queue, which is often publicly accessible. When an unsuspecting user clicks the link, the script runs in their session, potentially compromising the system under the user's authority. This issue was addressed in versions 5.0.11 and 6.0.4.

References