Live › vulnerability › CVE-2026-105456
RTIR, an add-on for Best Practical's RT ticketing system, loosens the HTML scrubber so any link containing a placeholder passes, including javascript: links. An attacker who can store HTML in a ticket, including an unauthenticated email to the Incident Reports queue, can get script to run in the session of any user who clicks the link and act with that user's RT permissions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 16:31 UTC. All times on this page are UTC.
Teams running RTIR on top of Request Tracker are exposed, and the flaw applies to the whole RT instance once RTIR is installed, not only to RTIR queues. Anyone who can add HTML to a ticket can exploit it, and the Incident Reports queue accepts email from anyone by default, so outside senders are a realistic path. Instances without RTIR installed are not affected by this change.
No product ranges from the sources yet.
5.0.116.0.4Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only to RTIR's own queues. Anyone who can add HTML content to a ticket on such an instance can store such a link. That includes an unauthenticated sender of HTML email to the Incident Reports queue, which RTIR opens to everyone by default. Script runs when a user clicks the link, in that user's session, and can act in RT with that user's authority.
This issue was fixed in version 5.0.11 and 6.0.4
This page as .md · .json · in your agent: get_signal("CVE-2026-105456")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.