{"id":"CVE-2026-105456","published":"2026-10-30T16:17:37.147","lastModified":"2026-10-30T19:37:07.073","description":"RTIR extends RT's HTML scrubber to allow an internal link\n      placeholder, and the extension lets through any link that merely\n      contains the placeholder, including links using the executable\n      javascript: scheme. The change applies to the whole RT instance\n      once RTIR is installed, not only to RTIR's own queues. Anyone who\n      can add HTML content to a ticket on such an instance can store\n      such a link. That includes an unauthenticated sender of HTML email\n      to the Incident Reports queue, which RTIR opens to everyone by\n      default. Script runs when a user clicks the link, in that user's\n      session, and can act in RT with that user's authority.\n\n\nThis issue was fixed in version 5.0.11 and 6.0.4","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://cert.pl/en/posts/2026/10/CVE-2026-105454","tags":[]},{"url":"https://requesttracker.com/rtir/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}