Description
Directory traversal vulnerability in Best Practical Solutions RT 3.2.0 through 3.6.10, 3.8.0 through 3.8.9, and 4.0.0rc through 4.0.0rc7 allows remote attackers to read arbitrary files via a crafted HTTP request.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | request-tracker3.8 | 3.8.8-7+squeeze1 | DSA-2220-1 |
| Debian 5.0 | request-tracker3.6 | 3.6.7-5+lenny6 | DSA-2220-1 |
Advisories 1
- DSA-2220-1 request-tracker3.8 - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- rt-unspecified-dir-traversal(66795) vdb-entry
- ADV-2011-1071 vdb-entry
- [rt-announce] 20110414 RT 3.8.10 Released - Security Release mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=696795
- http://blog.bestpractical.com/2011/04/security-vulnerabilities-in-rt.html
- 47383 vdb-entry
- [rt-announce] 20110414 Security vulnerabilities in RT mailing-list
- [rt-announce] 20110414 RT 3.6.11 Released - Security Release mailing-list
- DSA-2220 vendor-advisory
- 44189 third-party-advisory