Skip to content
OpenAdvisories
High · 7.2 CVE-2025-30087 EUVD-2025-16203GHSA-2jfq-9qf9-jmjj

Best Practical RT (Request Tracker) 4.4 through 4.4.7 and 5.0 through 5.0.7 allows XSS via injection of crafted parameters in a search URL.

Published May 28, 2025 · Updated Nov 3, 2025 · Assigned by mitre

Vendor: Best Practical Product: rt Package: request-tracker4 Package: request-tracker4 Package: request-tracker5 Package: request-tracker5 Ecosystem: Debian Ecosystem: Ubuntu

Description

Best Practical RT (Request Tracker) 4.4 through 4.4.7 and 5.0 through 5.0.7 allows XSS via injection of crafted parameters in a search URL.

Affected products

VendorProductAffectedFixed
bestpractical RT 4.4.0 – < 4.4.8, 5.0.0 – < 5.0.8 4.4.8

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 request-tracker5 5.0.7+dfsg-3 —
Debian 13 request-tracker5 5.0.7+dfsg-3 —
Debian 12 request-tracker4 4.4.6+dfsg-1.1+deb12u2 DSA-5911-1
Debian 12 request-tracker5 5.0.3+dfsg-3~deb12u3 DSA-5909-1
Debian 11 request-tracker4 4.4.4+dfsg-2+deb11u4 DLA-4157-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS request-tracker4 No fix yet —
Ubuntu 25.10 request-tracker4 No fix yet —
Ubuntu 24.04 LTS request-tracker4 No fix yet —
Ubuntu 22.04 LTS request-tracker4 No fix yet —
Ubuntu 20.04 LTS request-tracker4 No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS request-tracker4 No fix yet —
Ubuntu Pro 24.04 LTS request-tracker5 5.0.5+dfsg-2ubuntu0.1~esm1 USN-7692-1
Ubuntu Pro 22.04 LTS request-tracker5 5.0.1+dfsg-1ubuntu1+esm1 USN-7692-1
Ubuntu Pro 18.04 LTS request-tracker4 No fix yet —

Advisories 4

References