Description
RTIR extends RT's HTML scrubber to allow an internal link
placeholder, and the extension lets through any link that merely
contains the placeholder, including links using the executable
javascript: scheme. The change applies to the whole RT instance
once RTIR is installed, not only to RTIR's own queues. Anyone who
can add HTML content to a ticket on such an instance can store
such a link. That includes an unauthenticated sender of HTML email
to the Incident Reports queue, which RTIR opens to everyone by
default. Script runs when a user clicks the link, in that user's
session, and can act in RT with that user's authority.
This issue was fixed in version 5.0.11 and 6.0.4
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Best Practical Solutions | RT for Incident Response | 5.0.0 – < 5.0.11, 6.0.0 – < 6.0.4 | 5.0.11 |
References
- https://cert.pl/en/posts/2026/10/CVE-2026-105454 third-party-advisory
- https://requesttracker.com/rtir/ product