CVE-2026-61525
Received Received - Intake

Path Traversal in Zammad Helpdesk System

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description
Zammad is a web based open source helpdesk/customer support system. In 7.0.2 and 7.1.0, zammad's session management for websocket and long-polling connections is susceptible to a path traversal attack. Session identifiers supplied by the client are insufficiently validated before being used to construct internal file paths. When the file-based session store is active (the default configuration), an authenticated attacker can manipulate the session identifier to reference locations outside the intended storage directory, leading to the deletion of arbitrary files and directories on the server. Exploitation requires only a low-privilege authenticated session and a single crafted request. Instances configured to use the Redis-based session store are not affected. This issue is fixed in versions 7.0.3 and 7.1.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-26
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-61525
EUVD
EUVD-2026-87222

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
zammad zammad to 7.0.3 (exc)
zammad zammad to 7.1.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Zammad versions 7.0.2 and 7.1.0 have a session management flaw in websocket and long-polling connections. The issue is a path traversal vulnerability where session IDs are not properly validated before being used to create file paths. This allows authenticated attackers to manipulate session IDs to access files outside the intended directory, potentially deleting arbitrary files on the server.

Detection Guidance

To detect this vulnerability, check if your Zammad instance is running a vulnerable version (7.0.2 or 7.1.0) and is using the default file-based session store. Verify the session store type in your configuration. If using Redis, the system is not affected. Inspect session files for unusual paths or modifications.

Impact Analysis

An attacker with a low-privilege authenticated session could exploit this to delete critical files or directories on the server. This could disrupt service availability, corrupt data, or lead to further system compromise. Systems using the default file-based session store are at risk; those using Redis are unaffected.

Compliance Impact

This vulnerability could lead to unauthorized data deletion or system disruption, potentially violating integrity and availability requirements in GDPR and HIPAA. Unauthorized file access or deletion may also constitute a data breach, triggering mandatory reporting and compliance obligations under these regulations.

Mitigation Strategies

Upgrade Zammad to version 7.0.3 or 7.1.1 or later to fix the session management vulnerability. If using the file-based session store, consider switching to Redis-based sessions as they are not affected by this issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61525. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart