CVE-2026-105455

RTIR's ticket creation forms show the subject of the related ticket when splitting a ticket or creating an incident from a report, and they render that subject without HTML escaping. A ticket subject containing script runs it when a user opens either form. RTIR grants everyone the right to create Incident Reports by default, so an unauthenticated sender of an emailed report can set that subject. The script then runs in the session of the incident handler who creates an incident from the report or splits it, and can act in RT with that user's authority. The issue was fixed in version 6.0.4. RTIR 5.0 is not affected.

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/en/posts/2026/10/CVE-2026-105454
https://requesttracker.com/rtir/

Configurations

No configuration.

History

30 Oct 2026, 16:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-30 16:17

Updated : 2026-10-30 19:37

NVD link : CVE-2026-105455

Mitre link : CVE-2026-105455

CVE.ORG link : CVE-2026-105455

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-105455", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-105455", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-30T17:05:42.052215Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"repo": "https://github.com/bestpractical/rtir", "vendor": "Best Practical Solutions", "product": "RT for Incident Response", "versions": [{"status": "affected", "version": "6.0.0", "lessThan": "6.0.4", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-30T16:17:37.010", "references": [{"url": "https://cert.pl/en/posts/2026/10/CVE-2026-105454", "source": "cvd@cert.pl"}, {"url": "https://requesttracker.com/rtir/", "source": "cvd@cert.pl"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "RTIR's ticket creation forms show the subject of the related\n ticket when splitting a ticket or creating an incident from a\n report, and they render that subject without HTML escaping. A\n ticket subject containing script runs it when a user opens either\n form. RTIR grants everyone the right to create Incident Reports by\n default, so an unauthenticated sender of an emailed report can set\n that subject. The script then runs in the session of the incident\n handler who creates an incident from the report or splits it, and\n can act in RT with that user's authority.\u00a0\n\n\nThe issue was fixed in version 6.0.4. RTIR 5.0 is not\n affected."}], "lastModified": "2026-10-30T19:37:07.073", "sourceIdentifier": "cvd@cert.pl"}