Zammad CVE-2026-63006

Exploitation requires (1) a Zammad instance older than 7.1.2 that renders inbound email/ticket HTML to agents, and (2) an authenticated agent passively opening the attacker's message - the malicious <img src>/srcset URL fires as a same-origin GET carrying the agent's session cookie. The attacker needs no Zammad account (the payload is just an inbound email/ticket), but the effect only triggers on agent view (UI:P), and impact is limited to state-changing/disruptive same-origin API calls such as forced logout, not data exfiltration. Patched instances (>=7.1.2) that CGI.unescape twice and match dot-segments anywhere in the URL are not vulnerable.

This is a genuine but low-severity issue, and the signals are internally consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L) scores 5.3 (medium) and correctly reflects a low-impact flaw: no confidentiality loss, only limited integrity/availability effects (a forced logout / unwanted state-changing API call). Exploitation is network-delivered and needs no attacker authentication (the payload arrives as an ordinary inbound email or ticket), but it is gated on a victim agent passively viewing the malicious content (UI:P), which caps real-world impact. There is no EPSS score, no CISA KEV listing, and no public exploit provided - the patch commit does disclose the bypass payloads (interior '../', double-encoded '%252e%252e', backslash '..\'), which lowers the bar to reproduce, but that is not the same as active exploitation. Net: a real defect worth patching on a normal cadence, not an emergency; the primary consequence (session disruption) is a nuisance-grade effect rather than data theft or RCE. No key signals conflict here.

An attacker emails the helpdesk (or opens a ticket) containing HTML like <img src="/api/v1/attachments/../signout">, using path-traversal that the old sanitizer treated as a safe local URL. When an authenticated agent later opens that ticket, their browser silently resolves the path to Zammad's protected API endpoint and issues the request with the agent's session cookie, forcing a logout with no click required. No public exploit is published, but the fix commit's test cases enumerate working payload variants (literal, double-encoded, and backslash-separator).