CVE-2025-9158
CVE-2025-9158 · Stored XSS in Request Tracker
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Request Tracker software is vulnerable to a Stored XSS vulnerability in calendar invitation parsing feature, which displays invitation data without HTML sanitization. XSS vulnerability allows an attacker to send a specifically crafted e-mail enabling JavaScript code execution by displaying the ticket in the context of the logged-in user. This vulnerability affects versions from 5.0.4 through 5.0.8 and from 6.0.0 through 6.0.1.
CVSS 5.3 · Medium · EPSS 0.4% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
request tracker
- Versions
- ≥ 5.0.4, ≤ 5.0.8: Affected (custom)
- ≥ 6.0.0, ≤ 6.0.1: Affected (custom)
No fix published
request-tracker5 Debian:13
- Versions
- 5.0.7+dfsg-4
- Affected ranges
- ECOSYSTEM: < 5.0.7+dfsg-4+deb13u1
Update to 5.0.7+dfsg-4+deb13u1
request-tracker5 Debian:14
- Versions
- 5.0.7+dfsg-4
- Affected ranges
- ECOSYSTEM: < 5.0.7+dfsg-5
Update to 5.0.7+dfsg-5
request-tracker5 Ubuntu:Pro:22.04:LTS
- Versions
- 5.0.1+dfsg-1ubuntu1
- 5.0.1+dfsg-1ubuntu1+esm1
- 5.0.1+dfsg-1ubuntu1+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
request-tracker5 Ubuntu:Pro:24.04:LTS
- Versions
- 5.0.1+dfsg-1ubuntu1
- 5.0.5+dfsg-2
- 5.0.5+dfsg-2ubuntu0.1~esm1
- 5.0.5+dfsg-2ubuntu0.1~esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
request-tracker5 Ubuntu:25.10
- Versions
- 5.0.7+dfsg-2
- 5.0.7+dfsg-3
- 5.0.7+dfsg-4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
request-tracker5 Ubuntu:26.10
- Versions
- 5.0.7+dfsg-6
- 5.0.10+dfsg-1
- 5.0.10+dfsg-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
request-tracker5 Ubuntu:Pro:26.04:LTS
- Versions
- 5.0.7+dfsg-4
- 5.0.7+dfsg-6
- 5.0.7+dfsg-6ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published