p PatchFirst

CVE-2025-31500

CVE-2025-31500

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an Asset name.

CVSS 7.2 · High · EPSS 0.3% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • rt

    Versions
    • ≥ 5.0.0, < 5.0.8: Affected (semver)

    Update to 5.0.8

  • request-tracker5 Debian:12

    Versions
    • 5.0.3+dfsg-2
    • 5.0.3+dfsg-3~deb12u1
    • 5.0.3+dfsg-3~deb12u2
    Affected ranges
    • ECOSYSTEM: < 5.0.3+dfsg-3~deb12u3

    Update to 5.0.3+dfsg-3~deb12u3

  • request-tracker5 Debian:13

    Affected ranges
    • ECOSYSTEM: < 5.0.7+dfsg-3

    Update to 5.0.7+dfsg-3

  • request-tracker5 Debian:14

    Affected ranges
    • ECOSYSTEM: < 5.0.7+dfsg-3

    Update to 5.0.7+dfsg-3

  • request-tracker5 Ubuntu:Pro:22.04:LTS

    Versions
    • 5.0.1+dfsg-1ubuntu1
    Affected ranges
    • ECOSYSTEM: < 5.0.1+dfsg-1ubuntu1+esm1

    Update to 5.0.1+dfsg-1ubuntu1+esm1

  • request-tracker5 Ubuntu:Pro:24.04:LTS

    Versions
    • 5.0.1+dfsg-1ubuntu1
    • 5.0.5+dfsg-2
    Affected ranges
    • ECOSYSTEM: < 5.0.5+dfsg-2ubuntu0.1~esm1

    Update to 5.0.5+dfsg-2ubuntu0.1~esm1

Original sources

Check your server →