CVE-2022-25801

CRITICAL 9.1CVE-2022-25801 · Published 14/07/2022 · updated 17/06/2026

In short

CVE-2022-25801 is a CRITICAL (CVSS 9.1) vulnerability affecting request tracker for incident response (bestpractical).
Chance of exploitation in the next 30 days (EPSS): 0.91%, higher than 59.9% of all vulnerabilities.
Fix: update to 5.0.3, 4.0.3 or later.

Package	Affected versions	Patched versions
request tracker for incident response bestpractical	`≥ 5.0.0, < 5.0.3< 4.0.3`	`5.0.34.0.3`

Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via Scripted Action tools.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.