Zammad CVE-2026-56735

Exploitation requires only that the attacker send an HTML email to a Zammad instance running a version prior to 7.0.2 / 7.1.0, using an <img> tag whose srcset attribute references an external (http/https/ftp/protocol-relative) URL - the HtmlSanitizer::Strict allowlisted srcset for img but, unlike src, never applied the external-URL block. The limiting factor is required user interaction (UI:P): the leak only fires when a support agent actually opens the ticket containing the malicious image in a browser that honors srcset; it also depends on the instance being unpatched. No authentication is needed (PR:N - anyone who can email the helpdesk qualifies), and the default configuration is vulnerable.

This is a genuine but low-severity privacy/information-disclosure issue, not a code-execution or data-theft flaw. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N, score 5.3) correctly captures network delivery, no attacker authentication, and required user interaction (an agent must open the ticket), but VI:L (integrity) is overstated - the described impact is purely disclosure of the viewing agent's metadata (IP address, User-Agent, Referer, and exact view timestamp) with no modification of any system data. There is NO EPSS score, NO CISA KEV listing, and NO public exploit code identified at time of analysis, so this is 'no public exploit identified at time of analysis.' The practical bar is trivial to trigger (attacker only sends an email with a crafted srcset), which makes exploitation reliable, but the payoff is limited to tracking-pixel-grade reconnaissance rather than compromise. Net: a real, easily-triggered privacy leak but a low real-world priority - a modest-CVSS, modest-impact issue confined to a niche self-hosted product. No conflicting signals across sources; the description, commit diff, and CVSS all agree on scope.

An attacker emails the helpdesk an ordinary-looking support message whose HTML body contains an <img> tag with a srcset attribute pointing to an attacker-controlled server. Zammad's Strict sanitizer strips external URLs from src but not srcset, so when a support agent opens the ticket their browser silently fetches the attacker URL, leaking the agent's IP address, User-Agent, Referer, and the precise time the ticket was read. No public exploit code exists, but the attack requires only sending an email and works against unpatched default installs.