CVE-2026-44229: RT Issue Tracking System XSS Vulnerability

CVE-2026-44229 Overview

CVE-2026-44229 is a stored Cross-Site Scripting (XSS) vulnerability in Request Tracker (RT), the open source enterprise-grade issue and ticket tracking system maintained by Best Practical Solutions. The flaw affects RT versions 5.0.0 and above, and 6.0.0 and above, prior to 5.0.10 and 6.0.3. Uploaded content is served inline rather than as an attachment, allowing an authenticated user who can upload files to embed JavaScript. The malicious script executes in the browser session of any RT user who later views or downloads the file [CWE-79]. Best Practical released fixed versions 5.0.10 and 6.0.3 to remediate the issue.

Critical Impact
An authenticated attacker with upload privileges can execute arbitrary JavaScript in another RT user's browser session, enabling session hijacking, ticket manipulation, and privileged action abuse.

Affected Products

Request Tracker (RT) versions 5.0.0 through 5.0.9
Request Tracker (RT) versions 6.0.0 through 6.0.2
Best Practical Solutions RT deployments allowing authenticated file uploads

Discovery Timeline

2026-07-20 - CVE-2026-44229 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-44229

Vulnerability Analysis

Request Tracker allows authenticated users to attach files to tickets and correspondence. Affected versions serve uploaded content inline in the browser through HTTP response headers rather than forcing an attachment download. When a file with an HTML or JavaScript-executable MIME type is retrieved, the browser renders and executes its contents within the RT application origin. This enables stored XSS across ticket views and download links.

Any RT user who later opens the attachment triggers the payload in their authenticated session. Because the payload runs in the RT origin, it can read authenticated cookies, issue requests to the RT API on the victim's behalf, modify tickets, or exfiltrate ticket data. Administrators viewing malicious attachments face the highest impact due to broader privileges.

Root Cause

The root cause is an insecure Content-Disposition handling behavior. RT set the disposition to inline for uploaded content without restricting or sanitizing script-capable content types. Combined with the absence of a strict Content-Security-Policy on attachment responses, this permits the browser to execute attacker-controlled markup and scripts within the RT domain.

Attack Vector

Exploitation requires an authenticated account with permission to upload attachments to a ticket or queue. The attacker uploads a crafted file containing JavaScript, then waits for or induces another user to view or download the attachment. When the victim retrieves the file, the browser executes the script in the RT session context. The CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N vector reflects a network-reachable attack requiring low privileges and user interaction, with scope change into the victim's browser session.

No public proof-of-concept exploit is currently available. See the GitHub Security Advisory GHSA-x576-pvwp-c2qv for vendor technical details.

Detection Methods for CVE-2026-44229

Indicators of Compromise

Attachment records in the RT database containing HTML, SVG, or JavaScript MIME types uploaded by non-administrative users.
HTTP responses from RT /Ticket/Attachment/ endpoints returning Content-Disposition: inline with script-capable content.
Unexpected outbound requests from user browsers to external hosts immediately after opening RT attachments.

Detection Strategies

Audit stored attachments for content types such as text/html, image/svg+xml, or application/xhtml+xml and inspect payloads for <script> tags or event handlers.
Review web server access logs for attachment download requests correlated with subsequent anomalous API calls from the same session.
Deploy web application firewall rules that flag responses serving uploaded content inline with executable MIME types.

Monitoring Recommendations

Monitor RT application logs for privilege changes, ticket modifications, and permission edits performed shortly after attachment views.
Alert on new administrative sessions or session token reuse from unexpected IP addresses following attachment access.
Track user-agent and referer anomalies on RT API endpoints to detect scripted actions originating from attachment views.

How to Mitigate CVE-2026-44229

Immediate Actions Required

Upgrade RT to version 5.0.10 or 6.0.3 immediately using the release available at GitHub RT Release 6.0.3.
Audit existing attachments uploaded since the vulnerable versions were deployed and quarantine any containing executable markup.
Restrict upload permissions to trusted users and queues until patching is complete.

Patch Information

Best Practical Solutions fixed CVE-2026-44229 in RT 5.0.10 and 6.0.3. The patch enforces attachment downloads with a non-inline Content-Disposition for user-supplied content, preventing browser execution of uploaded scripts. Detailed remediation notes are published in the GitHub Security Advisory GHSA-x576-pvwp-c2qv.

Workarounds

Configure a reverse proxy to rewrite Content-Disposition headers on RT attachment endpoints to attachment for all responses.
Enforce a strict Content-Security-Policy header on RT responses that disables inline scripts and restricts script sources.
Temporarily disable upload permissions for untrusted RT users and queues until the patched version is deployed.

bash

# Example nginx reverse proxy override forcing attachment downloads
location ~ ^/(Ticket|Attachment)/Attachment/ {
    proxy_pass http://rt_backend;
    proxy_hide_header Content-Disposition;
    add_header Content-Disposition "attachment" always;
    add_header Content-Security-Policy "default-src 'none'; sandbox" always;
    add_header X-Content-Type-Options "nosniff" always;
}