ticket when splitting a ticket or creating an incident from a
report, and they render that subject without HTML escaping. A
ticket subject containing script runs it when a user opens either
form. RTIR grants everyone the right to create Incident Reports by
default, so an unauthenticated sender of an emailed report can set
that subject. The script then runs in the session of the incident
handler who creates an incident from the report or splits it, and
can act in RT with that user's authority.
The issue was fixed in version 6.0.4. RTIR 5.0 is not
affected.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Best Practical Solutions | RT for Incident Response | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Fri, 30 Oct 2026 18:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Fri, 30 Oct 2026 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | RTIR's ticket creation forms show the subject of the related ticket when splitting a ticket or creating an incident from a report, and they render that subject without HTML escaping. A ticket subject containing script runs it when a user opens either form. RTIR grants everyone the right to create Incident Reports by default, so an unauthenticated sender of an emailed report can set that subject. The script then runs in the session of the incident handler who creates an incident from the report or splits it, and can act in RT with that user's authority. The issue was fixed in version 6.0.4. RTIR 5.0 is not affected. | |
| Title | Stored XSS via related ticket subject on RTIR Split and Create Incident forms | |
| First Time appeared |
Best Practical Solutions
Best Practical Solutions rt For Incident Response |
|
| Weaknesses | CWE-79 | |
| CPEs | cpe:2.3:a:best_practical_solutions:rt_for_incident_response:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Best Practical Solutions
Best Practical Solutions rt For Incident Response |
|
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: CERT-PL
Published:
Updated: 2026-10-30T17:18:22.098Z
Reserved: 2026-10-05T14:00:11.458Z
Link: CVE-2026-105455
Vulnrichment
Updated: 2026-10-30T17:08:37.437Z
NVD
Status : Awaiting Analysis
Published: 2026-10-30T16:17:37.010
Modified: 2026-10-30T19:37:07.073
Link: CVE-2026-105455
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-30T16:15:14Z
-
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')