CVE-2026-44229

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting (XSS) vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload content can include JavaScript in the upload that will execute in the browser session of any RT user who later views or downloads it. This issue has been fixed in versions 5.0.10 and 6.0.3.

Database specific

{
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44229.json"
}

References

Affected packages

Git / github.com/bestpractical/rt

Affected ranges

Type

GIT

Repo

https://github.com/bestpractical/rt

Events

Introduced

84623aa0fd0dcc02d1821866d37ac824a902cec8

Introduced

b88a9bf29c440aa6a71fd91c48b4016ec7ab92f3

Fixed

4a8ed900956527a8845f22a7ab011ec3225be91b

Fixed

51f63bbd924b9277ec6d2db49a6d89e8f25da141

Database specific

{
    "extracted_events": [
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.0.3"
        },
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.0.10"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-44229.json"