CVE-2013-3736: Cross-site scripting (XSS) vulnerability in the MobileUI (aka RT-Extension-MobileUI) extension before 1.04...

Security readout for executives and security teams

This vulnerability affects older Request Tracker deployments using the MobileUI extension. A malicious attachment filename could be displayed as script or HTML in the mobile interface, potentially affecting staff who view the ticket. Business urgency depends on whether the old MobileUI extension is still installed and exposed to untrusted ticket submissions. Exposure is likely limited to organizations still running RT 4.0.0 through versions before 4.0.13 with RT-Extension-MobileUI before 1.04, especially where external users can submit tickets or attachments. Prioritize if the organization still uses this legacy RT MobileUI stack for externally submitted tickets. Otherwise, handle as a legacy hygiene item during platform inventory and upgrade planning. Mitigation focus: Upgrade RT-Extension-MobileUI to version 1.04 or later if still installed.; Upgrade Request Tracker 4.0 deployments to 4.0.13 or later where applicable.; Check Best Practical guidance before applying changes in production..

Prepared

Jun 14, 2026, 14:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.