CVE-2026-44229
Received Received - Intake

Cross-Site Scripting (XSS) in RT Issue Tracking System

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting (XSS) vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload content can include JavaScript in the upload that will execute in the browser session of any RT user who later views or downloads it. This issue has been fixed in versions 5.0.10 and 6.0.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-44229
EUVD
EUVD-2026-46078

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
bestpractical rt From 5.0.0 (inc) to 5.0.10 (exc)
bestpractical rt From 6.0.0 (inc) to 6.0.3 (exc)
bestpractical rt 6.0.3
bestpractical rt 5.0.0
bestpractical rt to 6.0.3 (exc)
bestpractical rt From 5.0.10 (inc) to 6.0.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-44229 is a Cross-Site Scripting (XSS) vulnerability in RT, a ticketing system. It occurs because uploaded content is served inline instead of as an attachment. An authenticated user with upload permissions can include malicious JavaScript in an upload, which executes in the browser session of any RT user who views or downloads the content.

Detection Guidance

To detect this vulnerability, check the RT version installed on your system. If it is between 5.0.0-5.0.9 or 6.0.0-6.0.2, the system is vulnerable. Use commands like 'rt --version' or check the version in the RT web interface or configuration files.

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript in the context of other users' sessions. This could lead to session hijacking, theft of sensitive data, or unauthorized actions performed on behalf of the victim user within the RT system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection requirements or HIPAA's privacy and security rules. Organizations using vulnerable RT versions may face compliance risks due to potential data breaches or unauthorized data exposure.

Mitigation Strategies

Upgrade RT to version 5.0.10 or 6.0.3 immediately. Alternatively, restrict upload permissions to trusted users or enable the AlwaysDownloadAttachments configuration option to force downloads instead of inline rendering.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44229. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart