Best Practical RT (Request Tracker) 4.4 through 4.4.7 and 5.0 through 5.0.7 allows XSS via injection of crafted parameters in a search URL.

Fix status by distribution

Fixed packages published by each distribution for this CVE

• Debian DEBIAN-CVE-2025-30087 request-tracker4 Fixed in: 4.4.4+dfsg-2+deb11u4
• Ubuntu UBUNTU-CVE-2025-30087 request-tracker4

References

• advisory github.com
• advisory nvd.nist.gov
• web docs.bestpractical.com
• web docs.bestpractical.com
• web docs.bestpractical.com
• web lists.debian.org