UBUNTU-CVE-2026-105454: Medium severity ubuntu/request-tracker5 vulnerability
RT's automatic link creation for URLs in HTML ticket content does not HTML-escape the URL it places in the link. A URL crafted to break out of the link's address can add a script that runs when the ticket history is displayed, with no further action by the viewer. Anyone who can add HTML content to a ticket can plant it. That includes an unauthenticated sender of HTML email to any queue that grants CreateTicket or ReplyToTicket to Everyone, which is routine for a queue that accepts mail from the public. The script runs in the session of any user who views the ticket, and can act in RT with that user's authority. This issue was fixed in version 5.0.11 and 6.0.4
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RTto a version that resolves this vulnerability.Fixed in 5.0.11 - Upgrade
Upgrade
RTto a version that resolves this vulnerability.Fixed in 6.0.4
Event History
Frequently Asked Questions
Which deployments are most exposed to unauthenticated exploitation?
Queues that accept email from the public and grant CreateTicket or ReplyToTicket to Everyone are exposed to an unauthenticated sender planting malicious HTML in a ticket. This configuration is described as routine for public-facing mail queues.
What must an attacker do to trigger the script after planting it?
The attacker only needs to add crafted HTML content containing a URL designed to break out of the generated link address. The script executes when a user displays the ticket history; the viewer does not need to take further action.
What is the impact when a ticket viewer is affected?
The script runs in the session of the user viewing the ticket and can act in RT with that user's authority. Confidentiality and integrity are affected, including across the subsequent system scope indicated by the vector.
Which fixed versions are identified?
The issue was fixed in RT version 5.0.11 and 6.0.4.