# CVE-2026-44230: Best Practical RT reflected XSS in search results chart

Source: https://junglewise.ai/threats/cve-2026-44230-best-practical-rt-reflected-xss-in-search-results-chart  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-20. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-44230 · Severity: medium · CVSS 6.1 · Published 2026-07-20

Best Practical RT (Request Tracker), an enterprise-grade ticket tracking system, is vulnerable to a security flaw in its search results chart pages. An attacker can trick a logged-in user into clicking a malicious link, allowing the attacker to run unauthorized scripts in the user's browser. This could lead to the theft of session information or the performance of unauthorized actions on behalf of the user.

Technologies: [Best Practical Solutions RT](https://junglewise.ai/threats/technologies/rt). Vendors: [Best Practical Solutions](https://junglewise.ai/threats/vendors/best-practical-solutions).

## Quick answers

**Is CVE-2026-44230 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44230 being exploited in the wild.

**How severe is CVE-2026-44230?** Medium severity, with a CVSS score of 6.1, published 20 July 2026.

**Which products and versions are affected?** Best Practical Solutions RT >= 5.0.4, < 5.0.10; >= 6.0.0, < 6.0.3.

**Is there a fix for CVE-2026-44230?** A patch was published on 2026-05-20: Fixes released in versions 5.0.10 and 6.0.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44230 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-44230?** Check whether you run Best Practical Solutions RT at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A reflected Cross-Site Scripting (XSS) vulnerability exists in Best Practical RT within the search-results chart component. The vulnerability is caused by improper neutralization of user-controllable input before it is rendered on the page (CWE-79). An unauthenticated remote attacker can exploit this by crafting a malicious URL and tricking an authenticated user into visiting it (User Interaction required). Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session, potentially leading to session hijacking or unauthorized state-changing actions. The issue is fixed in versions 5.0.10 and 6.0.3.

## Affected products

- Best Practical RT >= 5.0.4, < 5.0.10; >= 6.0.0, < 6.0.3

## Timeline

- 2026-05-20: patched: Fixes released in versions 5.0.10 and 6.0.3
- 2026-05-20: advisory: GitHub Security Advisory GHSA-p724-v26h-32g9 published
- 2026-07-20: disclosed: CVE-2026-44230 published to NVD

## References

- [https://github.com/bestpractical/rt/releases/tag/rt-6.0.3](https://github.com/bestpractical/rt/releases/tag/rt-6.0.3)
- [https://github.com/bestpractical/rt/security/advisories/GHSA-p724-v26h-32g9](https://github.com/bestpractical/rt/security/advisories/GHSA-p724-v26h-32g9)

## Related threats

- [Best Practical RT stored XSS via insufficient template escaping](https://junglewise.ai/threats/cve-2026-44228-best-practical-rt-stored-xss-via-insufficient-template-escaping)
- [Best Practical RT reflected XSS in search page URL parameters](https://junglewise.ai/threats/cve-2026-44227-best-practical-rt-reflected-xss-in-search-page-url-parameters)
- [Best Practical RT authentication bypass in LDAP authentication](https://junglewise.ai/threats/cve-2026-41076-best-practical-rt-authentication-bypass-in-ldap-authentication)
- [Best Practical RT spreadsheet injection in ticket exports](https://junglewise.ai/threats/cve-2026-41073-best-practical-rt-spreadsheet-injection-in-ticket-exports)