CVE-2026-105456
Received Received - Intake

XSS via Malicious Link in RTIR HTML Scrubber

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: CERT.PL

Description
RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only to RTIR's own queues. Anyone who can add HTML content to a ticket on such an instance can store such a link. That includes an unauthenticated sender of HTML email to the Incident Reports queue, which RTIR opens to everyone by default. Script runs when a user clicks the link, in that user's session, and can act in RT with that user's authority. This issue was fixed in version 5.0.11 and 6.0.4

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-105456
EUVD
EUVD-2026-114128

Affected Vendors & Products

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in RTIR allows malicious HTML content to include executable JavaScript links disguised as internal placeholders. When a user clicks such a link, the script runs with the user's permissions in RT, potentially allowing unauthorized actions within the system.

Impact Analysis

An attacker could trick users into clicking a malicious link, enabling them to perform actions as that user within RT. This could lead to data theft, unauthorized modifications, or further compromise of the system, especially if the user has elevated privileges.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Compliance may be compromised if sensitive data is exposed or altered.

Mitigation Strategies

Upgrade RTIR to version 5.0.11 or 6.0.4 or later to address the vulnerability. Disable the Incident Reports queue if not needed or restrict access to prevent unauthenticated HTML email submissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105456. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart