The vulnerability identified as CVE-2026-44229 affects bestpractical rt, an open source issue and ticket tracking system. Versions 5.0.0 through 5.0.9 and 6.0.0 through 6.0.2 are vulnerable to a Cross-Site Scripting (XSS) flaw due to improper handling of uploaded content. Specifically, uploaded files are served inline instead of as attachments, enabling an authenticated user with upload privileges to embed malicious JavaScript. This script executes in the context of any RT user who later views or downloads the content, potentially compromising their session or data. The issue is resolved in versions 5.0.10 and 6.0.3.

An authenticated user with upload permissions can inject malicious JavaScript into uploaded content. When other users view or download this content, the script executes in their browser sessions, potentially leading to session hijacking or other client-side impacts. The vulnerability does not affect availability and requires user interaction (viewing/downloading the content).

Upgrade affected installations to version 5.0.10 or later if on the 5.x branch, or to version 6.0.3 or later if on the 6.x branch, where the vulnerability has been fixed. No other mitigation or temporary workaround is indicated in the provided data.