CVE-2026-48212: Stored XSS in external pages
An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page.
This issue affects OTRS:
7.0.X 8.0.X 2023.X 2024.X 2025.X 2026.X before 2026.7.X
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OTRSto a version that resolves this vulnerability.Fixed in 2026.7.1
Event History
Frequently Asked Questions
Who can exploit this issue, and who is exposed to the payload?
Exploitation requires an OTRS administrator who can create or modify an OTRS Custom Page. Users who access the affected Custom Page in a browser may execute the stored JavaScript.
Which OTRS releases are affected?
Affected release families are 7.0.X, 8.0.X, and 2023.X through 2026.X. The issue is fixed in 2026.7.X and later; the provided information does not specify fixed versions for the other listed release families.
Does exploitation require user interaction?
Yes. A user must access the Custom Page containing the stored script for it to execute in that user's browser.