OTRS CVE-2026-78355

Requires an authenticated OTRS administrator account with access to the SendSupportBundle functionality in the admin interface; this is the core prerequisite. Exploitation is bounded by operating-system file permissions, which are NOT bypassed: on versions prior to OTRS 7 the deletable files are limited to those writable by the web server process, while on OTRS 7 and later they are limited to those accessible to the dedicated OTRS user - so overly permissive file ownership/permissions widen the blast radius. The primary demonstrated impact is deletion of files outside the intended directory; direct disclosure of arbitrary files to the attacker was not demonstrated because support bundles are delivered only to a predefined OTRS support address. Limiting factors for defenders: mandatory admin authentication, no bypass of OS permissions, and impact scoped to files accessible to the OTRS application process.

This is a high-CVSS (8.7) issue whose real-world risk is meaningfully constrained by its prerequisites. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H) confirms network reachability and low complexity, but PR:H means a valid OTRS administrator account is mandatory - this is the single largest mitigating factor and downgrades the practical threat from 'internet-wide mass exploitation' to 'abuse by a malicious or compromised admin.' No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is no evidence of active exploitation or widespread automated weaponization; the only source is the vendor's own security advisory (OTRS-SA-2026-12). Note a signal tension worth flagging: the vendor vector sets C:N (no confidentiality impact), yet the description states the bundle 'may additionally attempt to include controlled files' - the vendor resolves this by noting disclosure goes only to a predefined OTRS support address and arbitrary-file disclosure to the attacker was 'not demonstrated,' which justifies C:N but should be verified if your threat model includes a malicious support-channel recipient. Overall this is a defense-in-depth / insider-abuse priority rather than an emergency internet-facing patch, though admin accounts are frequently obtained via phishing or credential reuse, so it should not be dismissed.

An attacker who has obtained OTRS administrator credentials (e.g., via phishing, reused passwords, or a rogue insider) logs into the admin interface and invokes the SendSupportBundle feature, supplying a crafted path containing directory-traversal sequences. Because low attack complexity and no user interaction are required, the attacker can reliably delete files outside the intended directory that are writable by the OTRS process, potentially disrupting the application or host. No public exploit code was identified at the time of analysis; the issue is documented only in the vendor advisory.