CVE-2026-105456

RTIR extends RT's HTML scrubber to allow an internal link
      placeholder, and the extension lets through any link that merely
      contains the placeholder, including links using the executable
      javascript: scheme. The change applies to the whole RT instance
      once RTIR is installed, not only to RTIR's own queues. Anyone who
      can add HTML content to a ticket on such an instance can store
      such a link. That includes an unauthenticated sender of HTML email
      to the Incident Reports queue, which RTIR opens to everyone by
      default. Script runs when a user clicks the link, in that user's
      session, and can act in RT with that user's authority.


This issue was fixed in version 5.0.11 and 6.0.4