CVE-2026-44227: RT: Reflected Cross-Site Scripting via URL parameters
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting (XSS) vulnerability. An attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's browser session. There are no effective workarounds. Avoid following untrusted RT URLs. This issue has been fixed in version 6.0.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RTto a version that resolves this vulnerability.Fixed in 6.0.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44227?
CVE-2026-44227 has a medium severity score of 6.1.
How do I fix CVE-2026-44227?
To fix CVE-2026-44227, upgrade to Best Practical Solutions RT version 6.0.3 or later.
What type of vulnerability is CVE-2026-44227?
CVE-2026-44227 is a reflected Cross-Site Scripting (XSS) vulnerability.
Who is affected by CVE-2026-44227?
CVE-2026-44227 affects authenticated users of Best Practical Solutions RT versions 6.0.0 to 6.0.2.
What can an attacker do with CVE-2026-44227?
An attacker can execute arbitrary JavaScript in the browser of an authenticated RT user by tricking them into visiting a crafted URL.