CVE-2025-9158 Stored XSS in Request Tracker
Attackers can execute JavaScript in logged-in users' browsers via crafted emails in Request Tracker, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-9158?
CVE-2025-9158 is a medium-severity cross-site scripting vulnerability in Best Practical Request Tracker, published on 24 Oct 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Request Tracker software is vulnerable to a Stored XSS vulnerability in calendar invitation parsing feature, which displays invitation data without HTML sanitization. XSS vulnerability allows an attacker to send a specifically crafted e-mail enabling JavaScript code execution by displaying the ticket in the context of the logged-in user.
This vulnerability affects versions from 5.0.4 through 5.0.8 and from 6.0.0 through 6.0.1.
Weakness: CWE-79
Which versions are affected by CVE-2025-9158?
How do I fix CVE-2025-9158?
Upgrade to a fixed version.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-9158 being exploited?
There is no known exploitation of CVE-2025-9158 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2025-9158, GHSA-4wp5-pw3x-6v2m, UBUNTU-CVE-2025-9158.