RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 through 5.0.9 and 6.0.0 through 6.0.2 contain an SQL injection vulnerability. An authenticated user can craft input that is incorporated into database queries without proper validation, potentially allowing them to read or modify data in the RT database. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by restricting RT account access to trusted users.

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 through 6.0.2 contain a Cross-Site Request Forgery (CSRF) vulnerability. An attacker who can induce a logged-in RT user to visit a malicious web page can trigger arbitrary state-changing actions in RT on that user's behalf. This issue has been fixed in version 6.0.3.

Last updated 6 July 2026

Best Practical RT (Request Tracker) 4.4 through 4.4.7 and 5.0 through 5.0.7 allows XSS via injection of crafted parameters in a search URL.

Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an Asset name.

Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an RT permalink.

It was found that Request Tracker, a ticket tracking and management system, stored user passwords in its database by using insufficiently secure hashing algorithm. A local attacker, able to gain read access to the RT's database could use this flaw to conduct brute force password guessing attacks, potentially leading to disclosure of users' passwords.

References: [1] http://lists.bestpractical.com/pipermail/rt-announce/2011-January/000185.html [2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=610850 [3] http://www.debian.org/security/2011/dsa-2150

RT Development Snapshots archive URL: [4] http://download.bestpractical.com/pub/rt/devel/