CVE-2026-105456

MediumCVSS 5.3

Published: 30/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.45%

39th percentile - higher than 39% of all known CVEs

Summary

RTIR extends RT's HTML scrubber to allow an internal link placeholder and lets through any link containing that placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only RTIR's own queues. Anyone who can add HTML content to a ticket, including an unauthenticated sender of HTML email to the Incident Reports queue (open to everyone by default), can store such a link, and the script runs in the session of the user who clicks it. The issue was fixed in versions 5.0.11 and 6.0.4.

Risk Assessment

An unauthenticated sender can plant a malicious link in a ticket, and when a handler clicks it, script executes with that user's authority in RT.

Recommendation

Upgrade RTIR to version 5.0.11 or 6.0.4 (or later) and consider restricting access to the Incident Reports queue.

Other vulnerabilities in RTIR

CVE-2026-105455Medium
RTIR's ticket creation forms show the subject of the related ticket when splitting a ticket or creating an incident from a report, rendering that subject without HTML escaping. A ticket subject containing script runs it when a user opens either form. RTIR grants everyone the right to create Incident Reports by default, so an unauthenticated sender of an emailed report can set that subject, and the script runs in the session of the handler who creates or splits the incident. The issue was fixed in version 6.0.4; RTIR 5.0 is not affected.

Original NVD description (English source)

RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only to RTIR's own queues. Anyone who can add HTML content to a ticket on such an instance can store such a link. That includes an unauthenticated sender of HTML email to the Incident Reports queue, which RTIR opens to everyone by default. Script runs when a user clicks the link, in that user's session, and can act in RT with that user's authority. This issue was fixed in version 5.0.11 and 6.0.4

Vulnerability data from NVD (NIST) · CISA KEV · EPSS