CVE-2026-44230

medium

Published 2026-07-06 · Modified 2026-07-20

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

6.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v4 NEW

—

not yet in upstream

VIR risk

6.1

Description

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to (but not including) 5.0.10, and 6.0.0 up to (but not including) 6.0.3 contain a reflected Cross-Site Scripting (XSS) vulnerability where an attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's browser session. This issue has been fixed in versions 5.0.10 and 6.0.3.

Predictions

Exploit likelihood

71%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Debian Security Tracker · View original ↗ · DFSG

CVE-2026-44230 NameCVE-2026-44230 SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) Vulnerable and fixed packages The table below lists information on source packages. Source PackageReleaseVersionStatus request-tracker5 (PTS)bookworm5.0.3+dfsg-3~deb12u5fixed bookworm…

CVE-2026-44230

Name	CVE-2026-44230
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
request-tracker5 (PTS)	bookworm	5.0.3+dfsg-3~deb12u5	fixed
	bookworm (security)	5.0.3+dfsg-3~deb12u4	fixed
	trixie	5.0.7+dfsg-4+deb13u2	vulnerable
	trixie (security)	5.0.7+dfsg-4+deb13u1	vulnerable
	forky, sid	5.0.10+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
request-tracker5	source	bookworm	(not affected)
request-tracker5	source	(unstable)	5.0.10+dfsg-1

Notes

[bookworm] - request-tracker5 <not-affected> (Vulnerable code introduced later)
https://github.com/bestpractical/rt/releases/tag/rt-5.0.10
Introduced with: https://github.com/bestpractical/rt/commit/1db06229c5839a158f2365c436d9aa325d6ea459 (rt-5.0.4beta1)
Fixed by: https://github.com/bestpractical/rt/commit/510d8d6c6a260da22830039e362c990a6c029665 (rt-5.0.10)

Home - Debian Security - Source (Git)

Apply commands

text fix

Notes

[bookworm] - request-tracker5 <not-affected> (Vulnerable code introduced later)https://github.com/bestpractical/rt/releases/tag/rt-5.0.10Introduced with: https://github.com/bestpractical/rt/commit/1db06229c5839a158f2365c436d9aa325d6ea459 (rt-5.0.4beta1)Fixed by: https://github.com/bestpractical/rt/commit/510d8d6c6a260da22830039e362c990a6c029665 (rt-5.0.10)

OS impact

Debian Fixed 4 releases

Version	Status	Fixed in
trixie	Fixed	`5.0.7+dfsg-4+deb13u3`
sid	Fixed	`5.0.10+dfsg-1`
forky	Fixed	`5.0.10+dfsg-1`
bookworm	Fixed	`0`

Ubuntu Fixed 3 releases

Version	Status	Fixed in
resolute	Fixed	`5.0.7+dfsg-6ubuntu0.1~esm1`
noble	Fixed	`5.0.5+dfsg-2ubuntu0.1~esm2`
jammy	Fixed	`5.0.1+dfsg-1ubuntu1+esm2`

References

CWEs

CWE-79

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.