CVE-2025-9158: Stored XSS in Request Tracker
The Request Tracker software is vulnerable to a Stored XSS vulnerability in calendar invitation parsing feature, which displays invitation data without HTML sanitization. XSS vulnerability allows an attacker to send a specifically crafted e-mail enabling JavaScript code execution by displaying the ticket in the context of the logged-in user.
This vulnerability affects versions from 5.0.4 through 5.0.8 and from 6.0.0 through 6.0.1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9158?
CVE-2025-9158 is classified as a high severity vulnerability due to its potential for executing malicious JavaScript code.
How do I fix CVE-2025-9158?
To mitigate CVE-2025-9158, upgrade to the latest version of Request Tracker beyond 5.0.8 or 6.0.1, which includes the necessary patches.
What software is affected by CVE-2025-9158?
CVE-2025-9158 affects Best Practical Solutions Request Tracker versions between 5.0.4 and 5.0.8, as well as 6.0.0 and 6.0.1.
What type of attack can CVE-2025-9158 enable?
CVE-2025-9158 can enable stored cross-site scripting (XSS) attacks through calendar invitation parsing.
Can CVE-2025-9158 be exploited remotely?
Yes, CVE-2025-9158 can be exploited remotely if an attacker sends a crafted email to the affected system.