OTRS CVE-2026-48208

The attack requires that the target OTRS instance accepts inbound email and converts it into ticket articles, which is the standard deployment model for OTRS helpdesk systems. Exploitation is then triggered when an authenticated agent or customer (UI:R) opens the affected ticket in their browser - the attacker has no control over timing but can target any monitored email queue. No authentication is required from the attacker's side (PR:N per CVSS vector) - only the ability to send email to a monitored address. The CSP bypass is a key condition: environments that assumed their CSP policy prevented content injection attacks are still fully exposed. Limiting factors include the UI:R requirement (the ticket must actually be opened by a user) and the availability-only impact (no data exfiltration or code execution). The DoS is browser-scoped, not server-scoped, meaning the OTRS backend remains operational even during an attack.

The CVSS 3.1 base score of 6.5 (Medium) reflects a network-reachable, low-complexity attack requiring no privileges (PR:N) but needing user interaction (UI:R) to open the malicious ticket. The impact is availability-only (A:H, C:N, I:N) with unchanged scope, meaning the DoS is confined to the browser session of the user who opens the ticket rather than the server itself. No EPSS score was provided in the available intelligence, and the CVE is not listed in CISA's Known Exploited Vulnerabilities catalog, so no confirmed active exploitation is established. No POC code has been identified. In practice, this vulnerability is a realistic threat to help desk and customer portal operations: a malicious actor with the ability to submit an email to a monitored queue could force DoS conditions for every agent who opens the resulting ticket, potentially causing repeated browser crashes or slowdowns during incident handling. The CSP bypass component elevates the practical risk beyond what the CVSS score alone suggests, as defenders may incorrectly assume their CSP renders the attack moot. CVSS vector and description are consistent - no conflicting signals detected.

An attacker crafts an email embedding a malicious SVG payload - such as a deeply recursive SVG filter or exponential animation element reference - and sends it to an OTRS-monitored support inbox. When a support agent or customer portal user opens the resulting ticket, their browser begins rendering the SVG, consuming excessive CPU or memory and resulting in a browser hang or crash. No public exploit code has been identified, but the technique is well-understood in SVG abuse research and does not require sophisticated tooling.