EUVD lists unescaped-subject XSS flaw in Best Practical's RT for Incident Response (EUVD-2026-114130)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Best Practical Solutions
- Product
- RT for Incident Response
- First seen
Summary
The EUVD listing says RTIR's ticket creation forms render the related ticket subject without HTML escaping when splitting tickets or creating incidents. It gives a CVSS v3.1 score of 5.3/10 and was last updated 2026-10-30.
If you use Best Practical Solutions
Check the Best Practical advisory for a fixed RTIR release and upgrade when available
Limit who can split tickets or create incidents from reports until patched
Review existing RTIR ticket subjects for unexpected script or HTML content
Check the Best Practical advisory for a fixed Request Tracker release and upgrade when available
Treat links in untrusted ticket content with caution until patched
Restrict ticket editing rights to trusted users in the meantime
What the sources say 3
· Mastodon: “RT's automatic link creation for URLs in HTML ticket content does not HTML-escape the URL it places in the link.” Source
· Mastodon: “RTIR's ticket creation forms show the subject of the related ticket when splitting a ticket or creating an incident from a report, and they render that subject without HTML escaping.” Source
· Mastodon: “RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executabl” Source