| CVE ID | CVE-2025-9158 |
| Publication date | 24 October 2025 |
| Vendor | Best Practical |
| Product | Request Tracker |
| Vulnerable versions | From 5.0.4 through 5.0.8 and from 6.0.0 through 6.0.1 |
| Vulnerability type (CWE) | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') (CWE-79) |
| Report source | Own research |
Description
CERT Polska during own research has found a vulnerability in Best Practical Request Tracker software and participated in coordination of its disclosure.
The vulnerability CVE-2025-9158: The Request Tracker software is vulnerable to a Stored XSS vulnerability in calendar invitation parsing feature, which displays invitation data without HTML sanitization. XSS vulnerability allows an attacker to send a specifically crafted e-mail enabling JavaScript code execution by displaying the ticket in the context of the logged-in user.
This vulnerability affects versions from 5.0.4 through 5.0.8 and from 6.0.0 through 6.0.1.
More about the coordinated vulnerability disclosure process at CERT Polska can be found at https://cert.pl/en/cvd/.