CVE-2026-44229: RT: Cross-Site Scripting via inline-served uploaded content
Last updated 6 July 2026
Other sources
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting (XSS) vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload content can include JavaScript in the upload that will execute in the browser session of any RT user who later views or downloads it. This issue has been fixed in versions 5.0.10 and 6.0.3.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/request-tracker4to a version that resolves this vulnerability.Fixed in 4.4.6+dfsg-1.1+deb12u4 - Upgrade
Upgrade
debian/request-tracker5to a version that resolves this vulnerability.Fixed in 5.0.3+dfsg-3~deb12u6Fixed in 5.0.7+dfsg-4+deb13u3Fixed in 5.0.10+dfsg-3 - Upgrade
Upgrade
RTto a version that resolves this vulnerability.Fixed in 5.0.10 - Upgrade
Upgrade
RTto a version that resolves this vulnerability.Fixed in 6.0.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44229?
CVE-2026-44229 has a medium severity rating of 5.4.
What software is affected by CVE-2026-44229?
CVE-2026-44229 affects Request Tracker versions 5.0.0 and 6.0.0 and above, prior to 5.0.10 and 6.0.3.
How do I fix CVE-2026-44229?
To fix CVE-2026-44229, upgrade Request Tracker to version 5.0.10 or 6.0.3 or later.
What type of vulnerability is CVE-2026-44229?
CVE-2026-44229 is classified as a Cross-Site Scripting (XSS) vulnerability.
What risk does CVE-2026-44229 pose?
CVE-2026-44229 poses a risk of unauthorized script execution via inline-served uploaded content.