{"id":"CVE-2026-105456","kind":"vulnerability","aliases":["CVE-2026-105456"],"related":[],"title":"RTIR: HTML scrubber bypass lets stored javascript links run in RT sessions","description":"RTIR extends RT's HTML scrubber to allow an internal link\n      placeholder, and the extension lets through any link that merely\n      contains the placeholder, including links using the executable\n      javascript: scheme. The change applies to the whole RT instance\n      once RTIR is installed, not only to RTIR's own queues. Anyone who\n      can add HTML content to a ticket on such an instance can store\n      such a link. That includes an unauthenticated sender of HTML email\n      to the Incident Reports queue, which RTIR opens to everyone by\n      default. Script runs when a user clicks the link, in that user's\n      session, and can act in RT with that user's authority.\n\n\nThis issue was fixed in version 5.0.11 and 6.0.4","summary":"RTIR, an add-on for Best Practical's RT ticketing system, loosens the HTML scrubber so any link containing a placeholder passes, including javascript: links. An attacker who can store HTML in a ticket, including an unauthenticated email to the Incident Reports queue, can get script to run in the session of any user who clicks the link and act with that user's RT permissions.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["incident-response","package","rt","rtir","self-hosted"],"not_affected_if":["incident-reports-queue-restricted","rtir-not-installed","rtir-patched"],"how_to_check":"- Check whether RTIR is installed on the RT instance, for example by looking for the RTIR plugin in the RT installation's installed extensions.\n- Check the installed RTIR version against the fixed versions listed below.\n- Check whether the Incident Reports queue accepts email from outside the organisation.","fix":"- RTIR `5.0.11`\n- RTIR `6.0.4`","status":"open","published_at":"2026-10-30T16:17:37+00:00","first_seen_at":"2026-10-30T16:31:25+00:00","triaged_at":"2026-10-30T16:32:29+00:00","updated_at":"2026-10-30T16:32:29+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T16:32:29Z","model":"claude-haiku-5-5","output":{"fix":"- RTIR `5.0.11`\n- RTIR `6.0.4`","reach":"internet","title":"RTIR: HTML scrubber bypass lets stored javascript links run in RT sessions","impact":"high","summary":"RTIR, an add-on for Best Practical's RT ticketing system, loosens the HTML scrubber so any link containing a placeholder passes, including javascript: links. An attacker who can store HTML in a ticket, including an unauthenticated email to the Incident Reports queue, can get script to run in the session of any user who clicks the link and act with that user's RT permissions.","audience":"businesses","category":"package","nicknames":[],"who_cares":["rt","rtir","incident-response","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Script runs in a logged-in staff member's RT session and acts with their authority","analyst_note":"","how_to_check":"- Check whether RTIR is installed on the RT instance, for example by looking for the RTIR plugin in the RT installation's installed extensions.\n- Check the installed RTIR version against the fixed versions listed below.\n- Check whether the Incident Reports queue accepts email from outside the organisation.","plain_action":"","needs_analyst":false,"not_affected_if":["rtir-not-installed","rtir-patched","incident-reports-queue-restricted"],"who_is_affected":"Teams running RTIR on top of Request Tracker are exposed, and the flaw applies to the whole RT instance once RTIR is installed, not only to RTIR queues. Anyone who can add HTML to a ticket can exploit it, and the Incident Reports queue accepts email from anyone by default, so outside senders are a realistic path. Instances without RTIR installed are not affected by this change.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000753,"input_tokens":4265,"output_tokens":653,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-105456':15A,18A '-2026':14A,17A '5.0.11':212C '6.0.4':214C 'act':88B,198C 'add':31B,148C 'add-on':30B 'allow':102C 'anyon':145C 'appli':128C 'attack':55B 'author':205C 'best':34B 'bypass':4A 'chang':127C 'click':84B,188C 'contain':47B,116C 'content':150C 'cve':13A,16A 'default':182C 'email':66B,170C 'everyon':180C 'execut':123C 'extend':96C 'extens':109C 'fix':209C 'get':73B 'host':27B 'html':2A,42B,59B,99C,149C,169C 'incid':20B,69B,173C 'incident-respons':19B 'includ':51B,63B,119C,164C 'instal':137C 'instanc':133C,157C 'intern':104C 'issu':207C 'javascript':7A,52B,124C 'let':5A,110C 'link':8A,46B,53B,86B,105C,113C,120C,162C,190C 'loosen':40B 'mere':115C 'open':178C 'packag':22B 'pass':50B 'permiss':94B 'placehold':49B,106C,118C 'practic':35B 'queue':71B,144C,175C 'report':70B,174C 'respons':21B 'rt':11A,23B,37B,93B,97C,132C,200C 'rtir':1A,24B,28B,95C,135C,141C,177C 'run':9A,76B,184C 'scheme':125C 'script':74B,183C 'scrubber':3A,43B,100C 'self':26B 'self-host':25B 'sender':167C 'session':12A,79B,195C 'store':6A,58B,159C 'system':39B 'ticket':38B,62B,153C 'unauthent':65B,166C 'use':121C 'user':82B,91B,187C,193C,203C 'version':211C 'whole':131C","nicknames":[],"mitigations":[],"who_affected":"Teams running RTIR on top of Request Tracker are exposed, and the flaw applies to the whole RT instance once RTIR is installed, not only to RTIR queues. Anyone who can add HTML to a ticket can exploit it, and the Incident Reports queue accepts email from anyone by default, so outside senders are a realistic path. Instances without RTIR installed are not affected by this change.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T16:17:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105456","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105456","severity":null,"published_at":"2026-10-30T16:17:37+00:00","modified_at":"2026-10-30T16:17:37+00:00","first_seen_at":"2026-10-30T16:31:25+00:00","fetched_at":"2026-10-30T16:31:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}