CVE-2026-44228
Received Received - Intake

Stored XSS in RT Issue Tracking System

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3, contain a stored Cross-Site Scripting (XSS) vulnerability, where user-controlled data is rendered without proper HTML escaping. An authenticated user with permission to set the relevant data can inject JavaScript that executes when another RT user views the affected page. This issue has been fixed in version 6.0.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-44228
EUVD
EUVD-2026-46049

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
bestpractical rt From 6.0.0 (inc) to 6.0.3 (exc)
bestpractical request_tracker to 6.0.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-44228 is a stored Cross-Site Scripting (XSS) vulnerability in RT (Request Tracker) versions 6.0.0 to 6.0.2. It allows authenticated users with specific permissions to inject malicious JavaScript into user-controlled data fields. The injected script executes when other users view the affected page due to insufficient HTML escaping.

Detection Guidance

To detect this stored XSS vulnerability in RT, check the RT version installed on your system. Run: grep '^version' /opt/rt4/lib/RT.pm or similar path depending on installation. If the version is between 6.0.0 and 6.0.2, the system is vulnerable. Additionally, inspect user-modified fields like ticket subjects or custom fields for suspicious JavaScript code in the HTML source of affected pages.

Impact Analysis

This vulnerability could allow attackers to steal session cookies, perform actions on behalf of users, or deface the RT interface. It may also lead to unauthorized data access or manipulation if users interact with the injected scripts.

Compliance Impact

This stored XSS vulnerability could potentially violate GDPR and HIPAA by enabling unauthorized script execution that may access or manipulate sensitive user data. GDPR requires protection against unauthorized data access, while HIPAA mandates safeguards for protected health information. The vulnerability's impact depends on the data processed by RT and whether affected systems store regulated information.

Mitigation Strategies

Immediately upgrade RT to version 6.0.3 or later. If upgrading is not feasible, restrict content modification permissions to trusted users only. Regularly audit user-generated content for malicious scripts and monitor for unusual activity in RT logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44228. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart