Vulnerabilities in Request Tracker and RT for Incident Response software

Mateusz Szymaniec from CERT Polska discovered vulnerabilities in Request Tracker and RT for Incident Response software during his own research and participated in coordination of their disclosure.

The vulnerabilityCVE-2026-105454: RT's automatic link creation for URLs in HTML ticket content does not HTML-escape the URL it places in the link. A URL crafted to break out of the link's address can add a script that runs when the ticket history is displayed, with no further action by the viewer. Anyone who can add HTML content to a ticket can plant it. That includes an unauthenticated sender of HTML email to any queue that grants CreateTicket or ReplyToTicket to Everyone, which is common for a queue that accepts mails from the public. The script runs in a session of any user who views the ticket, and can act in RT with that user's authority.

This issue was fixed in version 5.0.11 and 6.0.4

The vulnerabilityCVE-2026-105455: RTIR's ticket creation forms show the subject of the related ticket when splitting a ticket or creating an incident from a report, and they render that subject without HTML escaping. A script in the ticket subject runs when a user opens either form. RTIR grants everyone the right to create Incident Reports by default, so an unauthenticated sender of an emailed report can set that subject. The script then runs in the session of the incident handler who creates an incident from the report or splits it, and can act in RT with that user's authority.

The issue was fixed in version 6.0.4. RTIR 5.0 is not affected.

The vulnerabilityCVE-2026-105456: RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only to RTIR's own queues. Anyone who can add HTML content to a ticket on such an instance can store such a link. That includes an unauthenticated sender of HTML email to the Incident Reports queue, which RTIR opens to everyone by default. Script runs when a user clicks the link, in that user's session, and can act in RT with that user's authority.

This issue was fixed in version 5.0.11 and 6.0.4