CVE-2026-102345: Zammad: Stored XSS in ticket article rendering in the new Vue-based interface
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the new Vue-based ticket interface can render ticket article content without the expected output encoding. An authenticated user can store markup in an article that is interpreted when another user views the ticket, enabling stored cross-site scripting. The default Content Security Policy limits practical impact, and the classic REST/CoffeeScript interface is not affected. This issue is fixed in version 7.1.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zammadto a version that resolves this vulnerability.Fixed in 7.1.2
Event History
Frequently Asked Questions
Which deployments are affected?
Zammad deployments running a version prior to 7.1.2 are affected only when users access ticket articles through the new Vue-based ticket interface. The classic REST/CoffeeScript interface is not affected.
What access does an attacker need?
An attacker must be an authenticated user who can store markup in a ticket article. The payload is interpreted when another user views the affected ticket through the new interface.
Does the default configuration reduce the impact?
Yes. The default Content Security Policy limits the practical impact of the stored cross-site scripting issue, although it does not prevent affected article content from being rendered without the expected output encoding.
What is the available remediation?
Upgrade Zammad to version 7.1.2, which fixes the issue.