CVE-2026-6841 is a reflected cross-site scripting vulnerability in Best Practical's Request Tracker product. The issue arises from improper neutralization of input in the "Page" parameter of GET requests, enabling execution of arbitrary JavaScript code in the context of the victim's browser. Affected versions include 5.0.4 up to 5.0.9 and 6.0.0 up to 6.0.2. The vulnerability has a CVSS 4.0 base score of 5.1, indicating a medium severity level. No known exploits are reported in the wild, and no official patch or remediation level has been disclosed by the vendor as of the published date.

Successful exploitation results in arbitrary JavaScript execution in the victim's browser, which could lead to session hijacking, information disclosure, or other client-side impacts typical of reflected XSS vulnerabilities. The vulnerability does not require privileges or user interaction beyond opening a crafted URL. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or filtering on the "Page" parameter at the application or web server level to mitigate reflected XSS risks. Additionally, educating users to avoid clicking suspicious URLs can reduce exposure.