CVE-2026-56735
Received Received - Intake

Stored XSS via srcset in Zammad Email Ticket

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, zammad's HTML sanitizer (HtmlSanitizer::Strict) blocks external URLs in to prevent remote content loading, but the srcset attribute, also allowlisted for , is not subject to the same check. This oversight allows an attacker to embed arbitrary external URLs in the srcset attribute just by sending an e-mail, effectively bypassing the external content protection. When an agent views the ticket containing the malicious srcset, the browser will silently load the attacker-controlled URL, resulting in the leakage of the agent's IP address, User-Agent, Referer, and the exact time the ticket was viewed. HtmlSanitizer::Strict got extended to block external URLs in the srcset attribute of tags. This was done to prevent tracking pixels and external content loading, which could compromise user privacy. This issue is fixed in versions 7.0.2 and 7.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-26
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-56735
EUVD
EUVD-2026-87215

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
zammad zammad 7.0.2
zammad zammad 7.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-82 The web application does not neutralize or incorrectly neutralizes scripting elements within attributes of HTML IMG tags, such as the src attribute.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Zammad is a helpdesk system vulnerable to a bypass in its HTML sanitizer. The system blocks external URLs in img tags but fails to block them in the srcset attribute of img tags. This allows attackers to embed tracking pixels or external content by sending a malicious email. When viewed, the browser loads the attacker-controlled URL, leaking the user's IP address, User-Agent, Referer, and viewing time.

Detection Guidance

This vulnerability can be detected by checking the Zammad version installed on your system. If the version is below 7.0.2 or 7.1.0, the system is vulnerable. Review email content in tickets for srcset attributes pointing to external URLs as a potential indicator of exploitation.

Impact Analysis

This vulnerability can expose your IP address, browser details, and the exact time you viewed a ticket. Attackers can use this to track agents or gather sensitive information without detection. It may also lead to privacy violations if combined with other exploits.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data like IP addresses without consent. For HIPAA, it may risk unauthorized access to protected health information if agents view tickets containing PHI. Organizations must patch to avoid compliance penalties.

Mitigation Strategies

Immediately upgrade Zammad to version 7.0.2 or 7.1.0 or later to patch the vulnerability. Review and monitor tickets for suspicious srcset attributes in HTML content. Consider disabling HTML sanitization temporarily if urgent updates are not feasible, but this may impact functionality.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56735. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart