CVE-2025-9158

Publication date 24 October 2025

Last updated 10 July 2026

Ubuntu priority

Description

The Request Tracker software is vulnerable to a Stored XSS vulnerability in calendar invitation parsing feature, which displays invitation data without HTML sanitization. XSS vulnerability allows an attacker to send a specifically crafted e-mail enabling JavaScript code execution by displaying the ticket in the context of the logged-in user. This vulnerability affects versions from 5.0.4 through 5.0.8 and from 6.0.0 through 6.0.1.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
request-tracker5	26.04 LTS resolute	Needs evaluation
	25.10 questing	Ignored end of life, was needs-triage
	25.04 plucky	Ignored end of life, was needs-triage
	24.04 LTS noble	Needs evaluation
	22.04 LTS jammy	Needs evaluation

Severity score breakdown

CVSS version: CVSS v4.0

Base score 5.3 · Medium

Base metrics

Parameter	Value
Attack vector	Network
Attack complexity	Low
Attack requirements	None
Privileges required	None
User interaction	Passive
Vulnerable system - Confidentiality impact	Low
Vulnerable system - Integrity impact	Low
Vulnerable system - Availability impact	None
Subsequent system - Confidentiality impact	None
Subsequent system - Integrity impact	None
Subsequent system - Availability impact	None

Scores

Parameter	Value
Base score	5.3 · Medium
Base + Threat score	-
Base + Environmental score	-
Base + Threat + Environmental score	-

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

CVE-2025-9158

Description

Status

Severity score breakdown

References

Other references

Access our resources on patching vulnerabilities