CVE-2026-34718 Zammad improperly neutralizes of script-related HTML tags in ticket articles
Attackers can store malicious data URIs in ticket articles, though CSP prevents execution, requiring an upgrade to Zammad to fully sanitize content.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-34718?
CVE-2026-34718 is a medium-severity cross-site scripting vulnerability in Zammad Zammad, published on 8 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the HTML sanitizer for ticket articles was missing proper sanitization of data: ... URI schemes, resulting in storing such malicious content in the database of the Zammad instance. The Zammad GUI is rendering this content, due to applied CSP rules no harm was done by e.g., clicking such a link. This vulnerability is fixed in 7.0.1 and 6.5.4.
Weakness: CWE-80
Which versions are affected by CVE-2026-34718?
It affects 1 product.
Products include Zammad Zammad.
How do I fix CVE-2026-34718?
No fix has been published for CVE-2026-34718 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-34718 being exploited?
There is no known exploitation of CVE-2026-34718 in the wild and no public exploit code.
Other vulnerabilities in Zammad Zammad
Sources
Also known as GHSA-c2cf-9fc7-jhf3.