CVE-2026-6841

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-6841
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6841.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-6841
Downstream
Published
2026-05-21T11:49:07.533Z
Modified
2026-08-12T03:51:17.310323414Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Reflected XSS in Request Tracker
Details

Request Tracker is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the "Page" parameter in GET requests. An attacker can craft a URL that, when opened, results in arbitrary JavaScript execution in the victim’s browser.

This vulnerability affects versions from 5.0.4 up to 5.0.9 and from 6.0.0 up to 6.0.2.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6841.json",
    "cna_assigner": "CERT-PL"
}
References

Affected packages

Git / github.com/bestpractical/rt

Affected ranges

Type
GIT
Repo
https://github.com/bestpractical/rt
Events
Introduced
0c0f0b05c77d54dff91e2345cbfe7fd5d5d9444b
Fixed
51f63bbd924b9277ec6d2db49a6d89e8f25da141
Introduced
84623aa0fd0dcc02d1821866d37ac824a902cec8
Fixed
4a8ed900956527a8845f22a7ab011ec3225be91b
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:bestpractical:request_tracker:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "5.0.4"
        },
        {
            "fixed": "5.0.10"
        },
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.0.3"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6841.json"