# CVE-2026-105454: Request Tracker stored XSS via unescaped URL in automatic links

Source: https://junglewise.ai/threats/cve-2026-105454-rt-s-automatic-link-creation-for-urls-in-html-ticket-content  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-105454 · Severity: info · Published 2026-10-30

Request Tracker is an open-source ticketing system used by teams to track support requests and workflows. The vulnerability allows stored cross-site scripting (XSS) attacks when URLs in HTML ticket content are automatically converted to links without proper escaping, enabling attackers to inject malicious scripts that execute in users' sessions with their authority.

Technologies: [Best Practical Solutions Request Tracker](https://junglewise.ai/threats/technologies/request-tracker). Vendors: [Best Practical Solutions](https://junglewise.ai/threats/vendors/best-practical-solutions).

## Quick answers

**Is CVE-2026-105454 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105454 being exploited in the wild.

**How severe is CVE-2026-105454?** Informational severity, published 30 October 2026.

**Which products and versions are affected?** Best Practical Solutions Request Tracker 5.0.0 through 5.0.10, 6.0.0 through 6.0.3.

**Is there a fix for CVE-2026-105454?** Yes: fixed in Request Tracker 5.0.11, 6.0.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105454 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-105454?** Check whether you run Best Practical Solutions Request Tracker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Request Tracker 5.0.11, 6.0.4

## Technical details

The vulnerability is an improper neutralization of input during web page generation (CWE-79) where RT's automatic link creation fails to HTML-escape URLs placed in link attributes. An attacker can craft a malicious URL in HTML content that breaks out of the href attribute and injects a script tag. This stored XSS executes in the context of any user viewing the ticket history, including unauthenticated email senders on public queues with CreateTicket or ReplyToTicket permissions to Everyone.

## Affected products

- Best Practical Solutions Request Tracker 5.0.0 through 5.0.10, 6.0.0 through 6.0.3

## Timeline

- 2026-10-30: disclosed

## References

- [https://cert.pl/en/posts/2026/10/CVE-2026-105454](https://cert.pl/en/posts/2026/10/CVE-2026-105454)
- [https://requesttracker.com/request-tracker/](https://requesttracker.com/request-tracker/)

## Related threats

- [Best Practical RT privilege escalation in REST 2.0 API](https://junglewise.ai/threats/cve-2026-44231-best-practical-rt-privilege-escalation-in-rest-2-0-api)
- [Best Practical RT stored XSS via inline uploaded content](https://junglewise.ai/threats/cve-2026-44229-best-practical-rt-stored-xss-via-inline-uploaded-content)
- [Best Practical RT SQL injection in JSON search entry_aggregator](https://junglewise.ai/threats/cve-2026-41075-best-practical-rt-sql-injection-in-json-search-entry-aggregator)
- [Best Practical RT Cross-Site Request Forgery](https://junglewise.ai/threats/cve-2026-41074-best-practical-rt-cross-site-request-forgery)
- [Best Practical Request Tracker reflected XSS in Page parameter](https://junglewise.ai/threats/cve-2026-6841-best-practical-request-tracker-reflected-xss-in-page-parameter)