Full Report
Cross-site Scripting vulnerability (CVE-2026-6841) has been found in Request Tracker software.
Analysis Summary
# Vulnerability: Reflected XSS in Request Tracker (CVE-2026-6841)
## CVE Details
- **CVE ID:** CVE-2026-6841
- **CVSS Score:** Not explicitly provided in source (Estimated: 6.1 Medium based on typical Reflected XSS metrics)
- **CWE:** CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-site Scripting)
## Affected Systems
- **Products:** Best Practical Request Tracker (RT)
- **Versions:**
- 5.0.4 through 5.0.9
- 6.0.0 through 6.0.2
- **Configurations:** Systems utilizing the web-based interface for ticket management.
## Vulnerability Description
Request Tracker is susceptible to a **reflected cross-site scripting (XSS)** vulnerability. The flaw exists due to improper sanitization of the `Page` parameter within GET requests. An attacker can inject malicious scripts into this parameter; when a victim clicks a specially crafted link, the script executes within the context of the victim's browser session.
## Exploitation
- **Status:** Not currently reported as exploited in the wild; discovered via coordinated disclosure research.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** Low/Medium (Potential theft of session cookies or sensitive data displayed on the page)
- **Integrity:** Low/Medium (Potential for unauthorized actions performed on behalf of the user)
- **Availability:** None
## Remediation
### Patches
The vendor (Best Practical) has released updates to address this vulnerability. Users should upgrade to:
- **Request Tracker 5.0.10** or higher
- **Request Tracker 6.0.3** or higher
### Workarounds
No specific official workarounds were provided. It is recommended to apply the security updates immediately. General XSS mitigation includes deploying a Content Security Policy (CSP) to restrict script execution.
## Detection
- **Indicators of Compromise:** Unusual URLs in web server access logs containing `<script>` tags or encoded JavaScript in the `Page` GET parameter.
- **Detection methods and tools:** Web Application Firewalls (WAFs) can be configured to detect and block XSS patterns in URL parameters.
## References
- **Vendor Advisories:** Best Practical Solutions
- **Relevant links:**
- hxxps[://]cert[.]pl/en/posts/2026/05/vulnerability-in-request-tracker-software/
- hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-6841
- hxxps[://]cwe[.]mitre[.]org/data/definitions/79[.]html