CVE-2025-9158

Name	CVE-2025-9158
Description	The Request Tracker software is vulnerable to a Stored XSS vulnerability in calendar invitation parsing feature, which displays invitation data without HTML sanitization. XSS vulnerability allows an attacker to send a specifically crafted e-mail enabling JavaScript code execution by displaying the ticket in the context of the logged-in user. This vulnerability affects versions from 5.0.4 through 5.0.8 and from 6.0.0 through 6.0.1.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
request-tracker5 (PTS)	bookworm	5.0.3+dfsg-3~deb12u3	fixed
	bookworm (security)	5.0.3+dfsg-3~deb12u4	fixed
	trixie (security)	5.0.7+dfsg-4+deb13u1	fixed
	forky, trixie	5.0.7+dfsg-4	vulnerable
	sid	5.0.7+dfsg-5	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
request-tracker5	source	bookworm	(not affected)
request-tracker5	source	trixie	5.0.7+dfsg-4+deb13u1
request-tracker5	source	(unstable)	5.0.7+dfsg-5

Notes

[bookworm] - request-tracker5 <not-affected> (Vulnerable code introduced later)
Fixed by: https://github.com/bestpractical/rt/commit/04b5694e6cd150492aa51b8edaba75f5997ea40c (rt-5.0.9)