CVE-2026-105456
RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only to RTIR's own queues. Anyone who can add HTML content to a ticket on such an instance can store such a link. That includes an unauthenticated sender of HTML email to the Incident Reports queue, which RTIR opens to everyone by default. Script runs when a user clicks the link, in that user's session, and can act in RT with that user's authority. This issue was fixed in version 5.0.11 and 6.0.4
Properties
- Cvss score
- 5.3
- First seen
- 2026-10-30T18:32:37+00:00
- Last seen
- 2026-10-30T18:32:37+00:00
- Euvd assigner
- CERT-PL
- Retrieved at
- 2026-10-30T20:09:45+00:00
- Src batch id
- euvd-20261030T193401Z-78899a
- Source url
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-114128
- Score
- 5.3
- Euvd base score version
- 4.0
- Fetched at
- 2026-10-30T19:34:21+00:00
- Euvd vendor
- Best Practical Solutions
- Cvss vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- First seen by Signal
- 2026-10-30T19:34:21+00:00
- Euvd base score
- 5.3
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Content hash
- 11e50d940a35444aabf7cfe7b3721433c1d70c7c4569d3bb3dc74d90ca4f3b48
- Published at
- 2026-10-30T16:17:37.147
- Last modified
- 2026-10-30T19:37:07.073
- Euvd updated
- 2026-10-30T18:32:37+00:00
- Euvd epss pct
- 0
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph