CVE-2026-63206

Received Received - Intake

HTML Sanitizer Bypass in Zammad via Shortened URLs

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and email views, can be bypassed using a shortened URL format that omits the double slash after the scheme (for example a shortened HTTP URL instead of a shortened HTTP URL). Modern browsers treat both forms as equivalent remote URLs. As a result, an attacker who sends a crafted email or ticket can cause the recipient's browser to silently load an image from an external server, revealing when and by whom the ticket was opened. Zammad's "remote content blocked" warning is not shown because the sanitizer does not recognize the shortened form as remote. This issue is fixed in version 7.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-63206

EUVD

EUVD-2026-87258

Affected Vendors & Products

Vendor	Product	Version / Range
zammad	zammad	to 7.1.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-184	The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

Executive Summary

Zammad is a helpdesk system vulnerable in versions before 7.1.2. Its HTML sanitizer blocks remote images but can be bypassed using shortened URLs that omit the double slash after the scheme (e.g., http:example.com instead of http://example.com). Modern browsers treat these as equivalent, allowing attackers to embed external images in emails or tickets. When opened, these images load silently, revealing the recipient's IP address and when the content was accessed.

Detection Guidance

This vulnerability involves bypassing Zammad's HTML sanitizer using shortened URLs (e.g., http:example.com instead of http://example.com). To detect it, inspect email or ticket content for shortened URLs that omit the double slash after the scheme. Check browser logs or network traffic for unexpected image loads from external servers when viewing Zammad tickets or emails.

Impact Analysis

This vulnerability allows attackers to track when and by whom a ticket or email is opened by loading external images. This can expose sensitive information like IP addresses and access times, compromising privacy and potentially enabling further attacks such as phishing or targeted surveillance.

Compliance Impact

This vulnerability may violate GDPR and HIPAA by enabling unauthorized tracking of user interactions with sensitive communications. GDPR requires protecting personal data, including IP addresses and access logs, while HIPAA mandates safeguarding protected health information. The tracking capability could lead to non-compliance and legal consequences.

Mitigation Strategies

Upgrade Zammad to version 7.1.2 or later to patch the HTML sanitizer issue. If upgrading is not immediately possible, manually review and sanitize incoming emails and tickets to remove shortened URLs or implement network-level filtering to block suspicious image loads.

Hi! I’m here to help you understand CVE-2026-63206. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70