RTIR: RT for Incident Response

RTIR 6.0.4 Release Notes

RTIR 6.0.4 -- 2026-10-29
========================

RTIR 6.0.4 is now available for general use. The list of changes
included with this release is below. In addition to the new features
and bug fixes listed below, this release contains security fixes. When
upgrading RTIR, you should also upgrade RT to version 6.0.4 for
compatibility with this release and to get the security fixes and
other improvements in RT 6.0.4.

https://download.bestpractical.com/pub/rt/release/RT-IR-6.0.4.tar.gz
https://download.bestpractical.com/pub/rt/release/RT-IR-6.0.4.tar.gz.asc

SHA-256 sums

107c95b220920571abeac2cd25bac92429a2c482642d49804eb3c13a0129cb57  RT-IR-6.0.4.tar.gz
9dade41c4644fad82738db124cca003c7fe625b83f957338a2beea4bda13793a  RT-IR-6.0.4.tar.gz.asc

Security

The following security issues are fixed in this release. Thanks to
Mateusz Szymaniec and CERT Polska for reporting these issues.

* RTIR 6.0 is vulnerable to stored cross-site scripting via the subject
of a related ticket on the Split and Create Incident forms. An
unauthenticated sender of an emailed incident report can set a subject
that runs script when an incident handler splits the report or creates
an incident from it. This vulnerability is assigned CVE-2026-105455.

* RTIR 6.0 is vulnerable to stored cross-site scripting via javascript:
links in HTML ticket content. RTIR's addition to RT's HTML scrubber
allows these links, and because it applies to the whole RT instance,
anyone who can add HTML content to a ticket can store one, including an
unauthenticated sender of email to the Incident Reports queue. This
vulnerability is assigned CVE-2026-105456.

General user features

* Skip CVE extraction for messages that mention more than 100 distinct
  CVEs; see UPGRADING-6.0 to change the limit
* URI-escape constituency names in RTIR links so names containing
  spaces or other special characters produce valid URLs
* Add a Spanish translation for RTIR
* Fix strings that could not be translated on the Advanced edit page
  and lookup tools
* Show the item title and publication date in the message of incidents
  created from External Feeds, rather than repeating the feed title and
  item link
* Check RTIRSearchEnabled against expected values in saved search
  options so that values like "No" are no longer treated as truthy
* Escape CVE IDs in the NVD link on CVE details

Documentation

* Document the RT $ShowUnreadMessageNotifications option for unread
  messages on incident listings

Internals

* Allow RTIR's own search arguments through RT's CSRF check
* Add a helper for processing po translation files
* Apply RTIR's custom field groupings to constituency queues with
  RT 6.0.4

Testing

* Add tests for reverse history in all display modes
* Add tests for the limit on the number of CVEs extracted from a
  message
* Add tests for RTIR links with escaped constituency names
* Add tests for the Owner "(Unchanged)" label on the RTIR Update page
* Click the Submit button when creating articles in tests, as RT now
  requires it to save an article
* Check only the attachment links in ticket history in tests, as RT's
  Attachments widget now also links each file
* Create constituencies before RT starts in constituency tests
* Update the GitHub actions Dockerfile to the latest test image


A complete changelog is available from git by running:
    git log 6.0.3..6.0.4
or visiting
    https://github.com/bestpractical/rtir/compare/6.0.3...6.0.4