CVE-2026-105455 Stored XSS via related ticket subject on RTIR Split and Create Incident forms

RTIR's ticket creation forms show the subject of the related ticket when splitting a ticket or creating an incident from a report, and they render that subject without HTML escaping. A ticket subject containing script runs it when a user opens either form. RTIR grants everyone the right to create...

CVE-2026-105455

The RTIR ticket creation forms are vulnerable to Stored XSS because they render the subject of a related ticket without HTML escaping when splitting a ticket or creating an incident from a report. An unauthenticated sender can provide a malicious script via an emailed report's subject. When an in...

CVE-2026-105455 Stored XSS via related ticket subject on RTIR Split and Create Incident forms

RTIR's ticket creation forms show the subject of the related ticket when splitting a ticket or creating an incident from a report, and they render that subject without HTML escaping. A ticket subject containing script runs it when a user opens either form. RTIR grants everyone the right to create...