CVE-2026-63006 Zammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcset
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-63006?
CVE-2026-63006 is a medium-severity vulnerability in zammad, published on 25 Sep 2026.
Official description
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browser resolves the URL to a protected API endpoint and sends the request with the agent's session cookie, enabling side effects such as forced logout without any user interaction. This issue is fixed in version 7.1.2.
Weakness: CWE-22
Which versions are affected by CVE-2026-63006?
How do I fix CVE-2026-63006?
No fix has been published for CVE-2026-63006 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-63006 being exploited?
There is no known exploitation of CVE-2026-63006 in the wild and no public exploit code.
Sources
Also known as GHSA-33p2-cm7w-62g3.