The Request Tracker software is vulnerable to a Stored XSS vulnerability in calendar invitation parsing feature, which displays invitation data without HTML sanitization. XSS vulnerability allows an attacker to send a specifically crafted e-mail enabling JavaScript code execution by displaying the ticket in the context of the logged-in user. This vulnerability affects versions from 5.0.4 through 5.0.8 and from 6.0.0 through 6.0.1.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Debian Linux - request-tracker5 - None (CVE-2025-9158)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 269c2de7-afaa-11f0-b4c8-792b26d8a051 advisory.

    Mateusz Szymaniec and CERT Polska Reports:
    RT is vulnerable to XSS via calendar invitations added to a            ticket. Thanks to Mateusz Szymaniec and CERT Polska for            reporting this finding.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6031 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6031-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     October 22, 2025                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : request-tracker5     CVE ID         : CVE-2025-9158 CVE-2025-61873

    Multiple vulnerabilities have been discovered in Request Tracker, an     extensible trouble-ticket tracking system, which could result in CSV     injection via ticket values with special characters, or cross-site     scripting via calendar invitations added to a ticket.

    For the oldstable distribution (bookworm), these problems have been     fixed in version 5.0.3+dfsg-3~deb12u4. The oldstable distribution     (bookworm) is only affected by CVE-2025-61873.

    For the stable distribution (trixie), these problems have been fixed in     version 5.0.7+dfsg-4+deb13u1.

    We recommend that you upgrade your request-tracker5 packages.

    For the detailed security status of request-tracker5 please refer to its     security tracker page at:
    https://security-tracker.debian.org/tracker/request-tracker5

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
271582	Linux Distros Unpatched Vulnerability : CVE-2025-9158	Nessus	Misc.	critical
271363	FreeBSD : RT -- XSS via calendar invitations (269c2de7-afaa-11f0-b4c8-792b26d8a051)	Nessus	FreeBSD Local Security Checks	medium
271215	Debian dsa-6031 : request-tracker5 - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2025-9158

medium

Tenable Plugins

critical

medium

critical