CVE-2026-44230: Bestpractical Request Tracker

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to (but not including) 5.0.10, and 6.0.0 up to (but not including) 6.0.3 contain a reflected Cross-Site Scripting (XSS) vulnerability where an attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's browser session. This issue has been fixed in versions 5.0.10 and 6.0.3.

Affected products

• Bestpractical Request Tracker: from 5.0.4, before 5.0.10 (fixed in 5.0.10); from 6.0.0, before 6.0.3 (fixed in 6.0.3)

Published 2026-07-20. Last modified 2026-08-07.