CVE-2026-105456 (GCVE-0-2026-105456)
Vulnerability from cvelistv5
Published
2026-10-30 15:22
Modified
2026-10-30 17:18
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Summary
RTIR extends RT's HTML scrubber to allow an internal link
placeholder, and the extension lets through any link that merely
contains the placeholder, including links using the executable
javascript: scheme. The change applies to the whole RT instance
once RTIR is installed, not only to RTIR's own queues. Anyone who
can add HTML content to a ticket on such an instance can store
such a link. That includes an unauthenticated sender of HTML email
to the Incident Reports queue, which RTIR opens to everyone by
default. Script runs when a user clicks the link, in that user's
session, and can act in RT with that user's authority.
This issue was fixed in version 5.0.11 and 6.0.4
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Best Practical Solutions | RT for Incident Response |
Version: 5.0.0 ≤ Version: 6.0.0 ≤ |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105456",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T17:05:31.942517Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T17:18:22.375Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RT for Incident Response",
"repo": "https://github.com/bestpractical/rtir",
"vendor": "Best Practical Solutions",
"versions": [
{
"lessThan": "5.0.11",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
},
{
"lessThan": "6.0.4",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:best_practical_solutions:rt_for_incident_response:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.0.11",
"versionStartIncluding": "5.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:best_practical_solutions:rt_for_incident_response:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.4",
"versionStartIncluding": "6.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mateusz Szymaniec (CERT.PL)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "RTIR extends RT\u0027s HTML scrubber to allow an internal link\n placeholder, and the extension lets through any link that merely\n contains the placeholder, including links using the executable\n javascript: scheme. The change applies to the whole RT instance\n once RTIR is installed, not only to RTIR\u0027s own queues. Anyone who\n can add HTML content to a ticket on such an instance can store\n such a link. That includes an unauthenticated sender of HTML email\n to the Incident Reports queue, which RTIR opens to everyone by\n default. Script runs when a user clicks the link, in that user\u0027s\n session, and can act in RT with that user\u0027s authority.\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eThis issue was fixed in version\u0026nbsp;5.0.11 and 6.0.4\u003c/div\u003e"
}
],
"value": "RTIR extends RT\u0027s HTML scrubber to allow an internal link\n placeholder, and the extension lets through any link that merely\n contains the placeholder, including links using the executable\n javascript: scheme. The change applies to the whole RT instance\n once RTIR is installed, not only to RTIR\u0027s own queues. Anyone who\n can add HTML content to a ticket on such an instance can store\n such a link. That includes an unauthenticated sender of HTML email\n to the Incident Reports queue, which RTIR opens to everyone by\n default. Script runs when a user clicks the link, in that user\u0027s\n session, and can act in RT with that user\u0027s authority.\n\n\nThis issue was fixed in version\u00a05.0.11 and 6.0.4"
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-592 Stored XSS"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:22:07.644Z",
"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"shortName": "CERT-PL"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://cert.pl/en/posts/2026/10/CVE-2026-105454"
},
{
"tags": [
"product"
],
"url": "https://requesttracker.com/rtir/"
}
],
"source": {
"discovery": "INTERNAL"
},
"tags": [
"x_open-source"
],
"title": "Stored XSS via HTML scrubber rule in RTIR",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"assignerShortName": "CERT-PL",
"cveId": "CVE-2026-105456",
"datePublished": "2026-10-30T15:22:07.644Z",
"dateReserved": "2026-10-05T14:00:11.458Z",
"dateUpdated": "2026-10-30T17:18:22.375Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-105456\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-30T17:05:31.942517Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-30T17:08:43.011Z\"}}], \"cna\": {\"tags\": [\"x_open-source\"], \"title\": \"Stored XSS via HTML scrubber rule in RTIR\", \"source\": {\"discovery\": \"INTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Mateusz Szymaniec (CERT.PL)\"}], \"impacts\": [{\"capecId\": \"CAPEC-592\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-592 Stored XSS\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 5.3, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"PASSIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"LOW\", \"vulnIntegrityImpact\": \"LOW\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"LOW\", \"vulnConfidentialityImpact\": \"LOW\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/bestpractical/rtir\", \"vendor\": \"Best Practical Solutions\", \"product\": \"RT for Incident Response\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.0.0\", \"lessThan\": \"5.0.11\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.0.0\", \"lessThan\": \"6.0.4\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://cert.pl/en/posts/2026/10/CVE-2026-105454\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://requesttracker.com/rtir/\", \"tags\": [\"product\"]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.3\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"RTIR extends RT\u0027s HTML scrubber to allow an internal link\\n placeholder, and the extension lets through any link that merely\\n contains the placeholder, including links using the executable\\n javascript: scheme. The change applies to the whole RT instance\\n once RTIR is installed, not only to RTIR\u0027s own queues. Anyone who\\n can add HTML content to a ticket on such an instance can store\\n such a link. That includes an unauthenticated sender of HTML email\\n to the Incident Reports queue, which RTIR opens to everyone by\\n default. Script runs when a user clicks the link, in that user\u0027s\\n session, and can act in RT with that user\u0027s authority.\\n\\n\\nThis issue was fixed in version\\u00a05.0.11 and 6.0.4\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"RTIR extends RT\u0027s HTML scrubber to allow an internal link\\n placeholder, and the extension lets through any link that merely\\n contains the placeholder, including links using the executable\\n javascript: scheme. The change applies to the whole RT instance\\n once RTIR is installed, not only to RTIR\u0027s own queues. Anyone who\\n can add HTML content to a ticket on such an instance can store\\n such a link. That includes an unauthenticated sender of HTML email\\n to the Incident Reports queue, which RTIR opens to everyone by\\n default. Script runs when a user clicks the link, in that user\u0027s\\n session, and can act in RT with that user\u0027s authority.\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eThis issue was fixed in version\u0026nbsp;5.0.11 and 6.0.4\u003c/div\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:best_practical_solutions:rt_for_incident_response:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.0.11\", \"versionStartIncluding\": \"5.0.0\"}, {\"criteria\": \"cpe:2.3:a:best_practical_solutions:rt_for_incident_response:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.0.4\", \"versionStartIncluding\": \"6.0.0\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}], \"providerMetadata\": {\"orgId\": \"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6\", \"shortName\": \"CERT-PL\", \"dateUpdated\": \"2026-10-30T15:22:07.644Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-105456\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-30T17:18:22.375Z\", \"dateReserved\": \"2026-10-05T14:00:11.458Z\", \"assignerOrgId\": \"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6\", \"datePublished\": \"2026-10-30T15:22:07.644Z\", \"assignerShortName\": \"CERT-PL\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…