CVE-2026-53804: OTRS Community Edition OS Command Injection via PGP Configuration
OTRS Community Edition contains an authenticated OS command injection vulnerability in the PGP encryption module that allows administrators to execute arbitrary operating-system commands by supplying crafted values for the PGP binary path and command options. Administrator-supplied configuration values are concatenated without sanitization into a shell command, enabling arbitrary command execution as the web server process user during normal ticket operations after the malicious configuration is deployed.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and what level of access is required?
An authenticated OTRS administrator can exploit it. The attacker must be able to modify the PGP encryption configuration, including the PGP binary path or command options.
When does the injected command run, and under which account?
The command executes during normal ticket operations after the malicious PGP configuration has been deployed. It runs with the privileges of the web server process user.
What can be done if patching is not immediately possible?
Restrict administrator access and prevent untrusted administrators from changing PGP binary-path and command-option settings. Review those configuration values for crafted shell commands and limit the web server process user's operating-system privileges.