RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting (XSS) vulnerability. An attacker who can ind…

Medium CVSS 6.1

CVECVE-2026-44227

First seen2026-08-07 15:15 UTC

Disclosed2026-07-20 18:16 UTC

Last updated2026-08-07 15:15 UTC

Channel statusauto

Summary

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting (XSS) vulnerability. An attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's browser session. There are no effective workarounds. Avoid following untrusted RT URLs. This issue has been fixed in version 6.0.3.

In-depth triage · Auto channel

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Affected products

Sources

NVD DATABASE

Original Links

https://github.com/bestpractical/rt/releases/tag/rt-6.0.3 Release Notes
https://github.com/bestpractical/rt/security/advisories/GHSA-7742-fhq7-ggv9 Vendor Advisory

Timeline

2026-08-07 nvd_ingest NVD