# CVE-2026-41075: Best Practical RT SQL injection in JSON search entry_aggregator

Source: https://junglewise.ai/threats/cve-2026-41075-best-practical-rt-sql-injection-in-json-search-entry-aggregator  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-22. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-41075 · Severity: high · CVSS 8.8 · Published 2026-05-22

Best Practical RT, an enterprise-grade ticket and issue tracking system, is vulnerable to a security flaw that could allow an authorized user to access or modify sensitive database information. By submitting specially crafted search requests, a user with a standard account could bypass security controls to view or change data they should not have access to. This could lead to the exposure of confidential support tickets, customer data, or the unauthorized modification of system records.

Technologies: [Best Practical Solutions Request Tracker](https://junglewise.ai/threats/technologies/request-tracker). Vendors: [Best Practical Solutions](https://junglewise.ai/threats/vendors/best-practical-solutions).

## Quick answers

**Is CVE-2026-41075 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41075 being exploited in the wild.

**How severe is CVE-2026-41075?** High severity, with a CVSS score of 8.8, published 22 May 2026.

**Which products and versions are affected?** Best Practical Solutions Request Tracker 5.0.0 to 5.0.9, 6.0.0 to 6.0.2.

**Is there a fix for CVE-2026-41075?** A patch was published on 2026-05-20: Versions 5.0.10 and 6.0.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41075 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-41075?** Check whether you run Best Practical Solutions Request Tracker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An SQL injection vulnerability exists in Best Practical RT versions 5.0.x (before 5.0.10) and 6.0.x (before 6.0.3). The flaw is located in the 'entry_aggregator' parameter within the JSON search functionality. An authenticated attacker can provide unvalidated input that is directly incorporated into database queries. This allows for the execution of arbitrary SQL commands, potentially leading to full database compromise, including the ability to read, modify, or delete data. The vulnerability is reachable over the network but requires at least low-level user authentication. Patches are available in versions 5.0.10 and 6.0.3.

## Affected products

- Best Practical RT (Request Tracker) 5.0.0 to 5.0.9, 6.0.0 to 6.0.2

## Timeline

- 2026-05-20: patched: Versions 5.0.10 and 6.0.3 released
- 2026-05-20: advisory: GitHub Security Advisory published
- 2026-05-22: disclosed: CVE published to NVD

## References

- [https://github.com/bestpractical/rt/releases/tag/rt-5.0.10](https://github.com/bestpractical/rt/releases/tag/rt-5.0.10)
- [https://github.com/bestpractical/rt/releases/tag/rt-6.0.3](https://github.com/bestpractical/rt/releases/tag/rt-6.0.3)
- [https://github.com/bestpractical/rt/security/advisories/GHSA-7vf8-xv7w-97c6](https://github.com/bestpractical/rt/security/advisories/GHSA-7vf8-xv7w-97c6)

## Related threats

- [Request Tracker stored XSS via unescaped URL in automatic links](https://junglewise.ai/threats/cve-2026-105454-rt-s-automatic-link-creation-for-urls-in-html-ticket-content)
- [Best Practical RT privilege escalation in REST 2.0 API](https://junglewise.ai/threats/cve-2026-44231-best-practical-rt-privilege-escalation-in-rest-2-0-api)
- [Best Practical RT stored XSS via inline uploaded content](https://junglewise.ai/threats/cve-2026-44229-best-practical-rt-stored-xss-via-inline-uploaded-content)
- [Best Practical RT Cross-Site Request Forgery](https://junglewise.ai/threats/cve-2026-41074-best-practical-rt-cross-site-request-forgery)
- [Best Practical Request Tracker reflected XSS in Page parameter](https://junglewise.ai/threats/cve-2026-6841-best-practical-request-tracker-reflected-xss-in-page-parameter)