CVE-2026-63006

Received Received - Intake

Path Traversal in Zammad Email Sanitizer

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browser resolves the URL to a protected API endpoint and sends the request with the agent's session cookie, enabling side effects such as forced logout without any user interaction. This issue is fixed in version 7.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-63006

EUVD

EUVD-2026-87270

Affected Vendors & Products

Vendor	Product	Version / Range
zammad	zammad	7.1.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

Zammad is a helpdesk system. Before version 7.1.2, attacker-controlled HTML in emails or tickets could bypass the image URL sanitizer using path traversal. When an authenticated agent views the content, the browser resolves the URL to a protected API endpoint and sends the request with the agent's session cookie, causing side effects like forced logout without user interaction.

Detection Guidance

This vulnerability involves attacker-controlled HTML in emails or tickets bypassing the image URL sanitizer in Zammad versions prior to 7.1.2. To detect it, check your Zammad version with: zammad version. If it is below 7.1.2, the system is vulnerable. Inspect inbound emails or tickets for suspicious URLs or HTML content that may contain path traversal sequences.

Impact Analysis

An attacker could force an authenticated agent to unknowingly send requests to protected API endpoints using their session cookie. This could lead to actions like forced logout or other unintended side effects without the agent's knowledge.

Mitigation Strategies

Upgrade Zammad to version 7.1.2 or later immediately. If upgrading is not immediately possible, restrict access to the Zammad instance to trusted networks or users until the update is applied. Monitor inbound emails and tickets for unusual HTML content or URLs.

Hi! I’m here to help you understand CVE-2026-63006. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70