CVE-2025-9158 Overview
CVE-2025-9158 is a stored cross-site scripting (XSS) vulnerability in Best Practical's Request Tracker (RT) ticketing software. The flaw resides in the calendar invitation parsing feature, which renders invitation data without applying HTML sanitization. An attacker can send a specially crafted email containing calendar invitation payloads that embed JavaScript. When a logged-in user views the resulting ticket, the browser executes the attacker-controlled script in the victim's session context. The vulnerability affects Request Tracker versions 5.0.4 through 5.0.8 and 6.0.0 through 6.0.1. This weakness is tracked as CWE-79.
Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in an authenticated RT user's browser by sending a crafted calendar invitation email, enabling session theft, ticket manipulation, and privilege abuse.
Affected Products
- Best Practical Request Tracker 5.0.4 through 5.0.8
- Best Practical Request Tracker 6.0.0 through 6.0.1
- Deployments processing inbound email with calendar invitations
Discovery Timeline
- 2025-10-24 - CVE-2025-9158 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-9158
Vulnerability Analysis
Request Tracker processes inbound email and extracts embedded calendar invitations (typically iCalendar .ics attachments) so that meeting metadata appears alongside the ticket. The parsing routine passes fields from the invitation into the ticket display layer without HTML-encoding or sanitizing untrusted content. Because these fields are attacker-controlled, an adversary can embed HTML and <script> payloads that persist in the ticket record. Any authenticated RT user who subsequently opens the ticket triggers script execution within the RT origin. The attacker requires no credentials on the target instance because inbound email is the delivery channel, and user interaction is limited to viewing the ticket.
Root Cause
The root cause is missing output sanitization when rendering calendar invitation fields inside the RT web interface. Calendar properties such as summary, description, organizer, and location accept arbitrary text and are stored verbatim. When the ticket view template emits these values, the framework treats them as trusted HTML rather than escaping them. This is a classic stored XSS pattern where an input-trusting parser feeds an output layer that assumes prior sanitization.
Attack Vector
The attack vector is network-based via SMTP. An attacker composes an email with a calendar invitation containing JavaScript inside one of the text fields. The email is delivered to an RT-monitored mailbox, which creates or updates a ticket. When a queue operator, agent, or administrator opens the ticket, the script runs with the victim's session privileges. The attacker can steal RT session cookies, submit authenticated requests on the victim's behalf, exfiltrate ticket contents, or pivot to administrative actions if the viewer holds elevated permissions.
No verified public proof-of-concept code is available. Refer to the CERT Poland advisory for CVE-2025-9158 for technical background.
Detection Methods for CVE-2025-9158
Indicators of Compromise
- Inbound emails containing .ics attachments or text/calendar MIME parts with HTML tags or <script> sequences inside SUMMARY, DESCRIPTION, LOCATION, or ORGANIZER fields.
- RT tickets whose calendar invitation display contains inline event handlers such as onerror, onload, or javascript: URIs.
- Unexpected outbound requests from RT user browsers to attacker-controlled hosts shortly after ticket views.
- Anomalous RT API calls or ticket modifications originating from privileged sessions without corresponding user activity.
Detection Strategies
- Inspect mail gateway logs for calendar attachments containing HTML entities or script tokens before delivery to RT queues.
- Search RT database ticket transactions for stored calendar content matching regex patterns such as <script, onerror=, or javascript:.
- Monitor browser Content Security Policy (CSP) violation reports from the RT origin for blocked inline script execution.
Monitoring Recommendations
- Enable verbose logging on the RT mail intake pipeline and retain raw message sources for forensic review.
- Correlate ticket-view events with subsequent authenticated RT API calls to identify session abuse.
- Alert on RT administrative actions performed within seconds of opening a newly created ticket sourced from an external email address.
How to Mitigate CVE-2025-9158
Immediate Actions Required
- Upgrade Request Tracker to a fixed release published by Best Practical that supersedes the 5.0.8 and 6.0.1 branches.
- Audit existing tickets containing calendar invitations for embedded HTML or script content and purge malicious entries.
- Rotate RT session secrets and force reauthentication for privileged users if exploitation is suspected.
Patch Information
Best Practical maintains Request Tracker release notes and security advisories on the official Request Tracker site. Administrators running versions 5.0.4–5.0.8 or 6.0.0–6.0.1 should apply the vendor-provided fix that adds HTML sanitization to calendar invitation rendering. Consult the CERT Poland advisory for coordinated disclosure details and fixed version references.
Workarounds
- Disable or strip calendar invitation parsing at the mail gateway until the patch is applied.
- Configure a strict Content Security Policy on the RT web server that forbids inline script execution and unsafe event handlers.
- Restrict RT inbound email to authenticated senders or trusted domains to reduce unauthenticated attack surface.
# Example CSP header for the RT web server (Apache)
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
