CVE-2026-63006: Zammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcset
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browser resolves the URL to a protected API endpoint and sends the request with the agent's session cookie, enabling side effects such as forced logout without any user interaction. This issue is fixed in version 7.1.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zammadto a version that resolves this vulnerability.Fixed in 7.1.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Zammad instances prior to 7.1.2 are exposed when they process attacker-controlled HTML in inbound emails or tickets and an authenticated agent later views that content.
What must an attacker do to exploit it?
The attacker needs to submit HTML containing an image src or srcset URL that uses path-traversal sequences to bypass the sanitizer's API-path allowlist. The payload is triggered when an authenticated agent views the affected content.
Does exploitation require the agent to click or interact with the content?
No. The browser resolves the crafted image URL and sends the request with the viewing agent's session cookie without user interaction.
What is the immediate remediation?
Upgrade Zammad to version 7.1.2, which fixes the issue.