Read the docs
TI-2026-45006 Aliases CVE-2026-63006

Zammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcset

Priority LOW 31CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browser resolves the URL to a protected API endpoint and sends the request with the agent's session cookie, enabling side effects such as forced logout without any user interaction. This issue is fixed in version 7.1.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0048 41st percentileScored 2026-11-07
Fix Fixed zammad (zammad): 7.1.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Zammad GmbHzammadbefore 7.1.27.1.2Patch availableCNA
  • zammad VendorZammad GmbH Affected before 7.1.2 Fixed in 7.1.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:*——Zammad GmbH
  • cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:* Versions — — ·Zammad GmbH

Remediation

  • Fix · CNA zammad (zammad) Fixed in 7.1.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-63006

References

Other 2

  • TI-2026-65406 Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package KEVCVSS 4.0CRITICAL 9.4
  • TI-2026-65405 Undisclosed RCE in Zammad v6.3 and higher KEVCVSS 4.0CRITICAL 9.4
  • TI-2024-22252 An issue was discovered in Zammad before 6.3.0. CVSS 3.1CRITICAL 9.1
  • TI-2026-11233 Zammad 7.0.1 - Improper authorization in ticket article attachment cloning CVSS 4.0HIGH 7.1
  • TI-2022-23785 A vulnerability in Zammad v5.3.0 allows attackers to execute arbitrary code or escalate… CVSS 3.1CRITICAL 9.8
  • TI-2026-58043 Zammad: Account takeover via unverified email matching during SSO auto-link CVSS 4.0CRITICAL 9.1
See all 123 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences