Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an Asset name.

Fix status by distribution

Fixed packages published by each distribution for this CVE

• Debian DEBIAN-CVE-2025-31500 request-tracker5 Fixed in: 5.0.3+dfsg-3~deb12u3

References

• advisory github.com
• advisory nvd.nist.gov
• web docs.bestpractical.com
• web docs.bestpractical.com