RT is an open source ticket tracking system that sanitizes user input incorrectly for URL parameters. The flaw is a classic reflected XSS (CWE-79) that, when an authenticated user visits a specially crafted URL, causes the browser to execute attacker-controlled JavaScript. This can lead to session hijacking, credential theft, or the execution of malicious code as the victim, compromising both confidentiality and integrity of the user session. Versions 6.0.0 through 6.0.2 contain this flaw, and no effective workarounds are available; users should avoid clicking untrusted URLs.

The vulnerability affects RT 6.0.0 through 6.0.2, released by bestpractical. The affected product is the RT issue and ticket tracking application; any deployment of these versions is susceptible.

The CVSS score of 6.1 indicates moderate threat. The EPSS score of 0.00155 and the issue not listed in CISA’s KEV catalog suggest very low exploitation probability and no widely publicized exploitation yet. The likely attack vector is a malicious URL sent to an authenticated user, who then unknowingly triggers the XSS by visiting the link. Because the flaw is reflected and requires user interaction, the risk remains moderate but could be leveraged by targeted attacks against privileged users.