Directory traversal vulnerability in Best Practical Solutions RT 3.2.0 through 3.6.10, 3.8.0 through 3.8.9, and 4.0.0rc through 4.0.0rc7 all

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• bestpractical rt3.2.0
• bestpractical rt3.2.1
• bestpractical rt3.2.2
• bestpractical rt3.2.3
• bestpractical rt3.4.0
• bestpractical rt3.4.1
• bestpractical rt3.4.2
• bestpractical rt3.4.3
• bestpractical rt3.4.4
• bestpractical rt3.4.5
• bestpractical rt3.4.6
• bestpractical rt3.6.0
• bestpractical rt3.6.1
• bestpractical rt3.6.10
• bestpractical rt3.6.2
• bestpractical rt3.6.3
• bestpractical rt3.6.4
• bestpractical rt3.6.5
• bestpractical rt3.6.6
• bestpractical rt3.6.7

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-41075RT: SQL injection via entry_aggregator parameter in JSON search
  35Monitor
• CVE-2026-41076RT: LDAP authentication bypass via empty password
  32Monitor
• CVE-2011-5092Best Practical Solutions RT 3.8.x before 3.8.12 and 4.x before 4.0.6 allows remote attackers to execute arbitrary code and gain privileges v
  31Monitor
• CVE-2026-41074RT has broken CSRF protection for authenticated users
  28Monitor
• CVE-2013-3370Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 does not properly restrict access to private callback components, which all
  28Monitor
• CVE-2011-4458Best Practical Solutions RT 3.6.x, 3.7.x, and 3.8.x before 3.8.12 and 4.x before 4.0.6, when the VERPPrefix and VERPDomain options are enabl
  28Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A user-supplied file name is joined with the allowed directory, but the result is never checked to confirm it is still inside that directory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const file = path.join(ROOT, req.query.name);2res.sendFile(file);

1const file = path.resolve(ROOT, req.query.name);2if (!file.startsWith(ROOT + path.sep)) {3  return res.sendStatus(400);4}5res.sendFile(file);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.