CVE-2025-9158 — Cross-site Scripting in Request-tracker5

CWE-79 — Cross-site Scripting4 documents4 sources

Severity

5.3MEDIUMNVD

EPSS

0.1%

top 71.95%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Debian Request-tracker5 Best Practical Request Tracker

Timeline

PublishedOct 24

Description

The Request Tracker software is vulnerable to a Stored XSS vulnerability in calendar invitation parsing feature, which displays invitation data without HTML sanitization. XSS vulnerability allows an attacker to send a specifically crafted e-mail enabling JavaScript code execution by displaying the ticket in the context of the logged-in user. This vulnerability affects versions from 5.0.4 through 5.0.8 and from 6.0.0 through 6.0.1.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Affected Packages2 packages

▶debiandebian/request-tracker5< request-tracker5 5.0.7+dfsg-5 (forky)

▶CVEListV5best_practical/request_tracker5.0.4 — 5.0.8+1

🔴Vulnerability Details

OSV

CVE-2025-9158: The Request Tracker software is vulnerable to a Stored XSS vulnerability in calendar invitation parsing feature, which displays invitation data withou↗2025-10-24

▶

GHSA

GHSA-4wp5-pw3x-6v2m: The Request Tracker software is vulnerable to a Stored XSS vulnerability in calendar invitation parsing feature, which displays invitation data withou↗2025-10-24

▶

📋Vendor Advisories

Debian

CVE-2025-9158: request-tracker5 - The Request Tracker software is vulnerable to a Stored XSS vulnerability in cale...↗2025

▶