CVE-2026-6841

Request Tracker is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the "Page" parameter in GET requests. An attacker can craft a URL that, when opened, results in arbitrary JavaScript execution in the victim’s browser. This vulnerability affects versions from 5.0.4 up to 5.0.9 and from 6.0.0 up to 6.0.2.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://cert.pl/en/posts/2026/05/CVE-2026-6841	Third Party Advisory
https://docs.bestpractical.com/release-notes/rt/5.0.10	Release Notes
https://docs.bestpractical.com/release-notes/rt/6.0.3	Release Notes
https://requesttracker.com/request-tracker/	Product

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:bestpractical:request_tracker::::::::
	cpe:2.3:a:bestpractical:request_tracker::::::::

History

01 Jun 2026, 14:02

Type	Values Removed	Values Added
CPE		cpe:2.3:a:bestpractical:request_tracker::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.1
First Time		Bestpractical request Tracker Bestpractical
References	~~() https://cert.pl/en/posts/2026/05/CVE-2026-6841 -~~	() https://cert.pl/en/posts/2026/05/CVE-2026-6841 - Third Party Advisory
References	~~() https://docs.bestpractical.com/release-notes/rt/5.0.10 -~~	() https://docs.bestpractical.com/release-notes/rt/5.0.10 - Release Notes
References	~~() https://docs.bestpractical.com/release-notes/rt/6.0.3 -~~	() https://docs.bestpractical.com/release-notes/rt/6.0.3 - Release Notes
References	~~() https://requesttracker.com/request-tracker/ -~~	() https://requesttracker.com/request-tracker/ - Product

21 May 2026, 13:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-21 13:16

Updated : 2026-06-01 14:02

NVD link : CVE-2026-6841

Mitre link : CVE-2026-6841

CVE.ORG link : CVE-2026-6841

JSON object : View

Products Affected

bestpractical

request_tracker

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-6841", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-05-21T13:16:20.273", "references": [{"url": "https://cert.pl/en/posts/2026/05/CVE-2026-6841", "tags": ["Third Party Advisory"], "source": "cvd@cert.pl"}, {"url": "https://docs.bestpractical.com/release-notes/rt/5.0.10", "tags": ["Release Notes"], "source": "cvd@cert.pl"}, {"url": "https://docs.bestpractical.com/release-notes/rt/6.0.3", "tags": ["Release Notes"], "source": "cvd@cert.pl"}, {"url": "https://requesttracker.com/request-tracker/", "tags": ["Product"], "source": "cvd@cert.pl"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Request Tracker is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the \"Page\" parameter in GET requests. An attacker can craft a URL that, when opened, results in arbitrary JavaScript execution in the victim\u2019s browser.\n\nThis vulnerability affects versions from 5.0.4 up to 5.0.9 and from 6.0.0 up to\u00a06.0.2."}], "lastModified": "2026-06-01T14:02:21.180", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bestpractical:request_tracker:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B391CF4D-CACE-4C0D-8717-2D3E73AFF79C", "versionEndExcluding": "5.0.10", "versionStartIncluding": "5.0.4"}, {"criteria": "cpe:2.3:a:bestpractical:request_tracker:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C106711D-0178-4681-BA2F-081792A36275", "versionEndExcluding": "6.0.3", "versionStartIncluding": "6.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cvd@cert.pl"}