Is there a patch available for EUVD-2026-20558?

Yes, a patch is available for EUVD-2026-20558. Update the affected software to the latest version immediately.

Zammad EUVD-2026-20558

Q: What is the CVSS score of EUVD-2026-20558?

EUVD-2026-20558 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-34718 MEDIUM

Basic XSS (CWE-80)

2026-04-08 GitHub_M

XSS Zammad

5.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

7.0.1,6.5.4

EUVD ID Assigned

Apr 08, 2026 - 19:31 euvd

EUVD-2026-20558

Analysis Generated

Apr 08, 2026 - 19:31 vuln.today

CVE Published

Apr 08, 2026 - 18:01 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the HTML sanitizer for ticket articles was missing proper sanitization of data: ... URI schemes, resulting in storing such malicious content in the database of the Zammad instance. The Zammad GUI is rendering this content, due to applied CSP rules no harm was done by e.g., clicking such a link. This vulnerability is fixed in 7.0.1 and 6.5.4.

AnalysisAI

Improper HTML sanitization in Zammad ticket article processing prior to versions 7.0.1 and 6.5.4 allows unauthenticated remote attackers to inject malicious data URI schemes that persist in the database, potentially enabling stored cross-site scripting (XSS) attacks. While current Content Security Policy mitigations prevent immediate harm from link clicks, the vulnerability represents a persistent data integrity issue and stored XSS vector that could be exploited if CSP rules are modified or bypassed. No public exploit code has been identified, but the vulnerability affects all instances running unpatched versions.

Technical ContextAI

Zammad is an open-source web-based helpdesk system that processes and stores user-submitted ticket articles in an HTML format. The vulnerability stems from CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page) in the HTML sanitizer component responsible for cleaning ticket article input before storage. The sanitizer failed to properly filter malicious data URI schemes (such as data:text/html,<script>alert(1)</script>) which are then rendered by the Zammad GUI when displaying stored ticket content. While the application's Content Security Policy provides a secondary defense layer preventing script execution on click, the root cause is insufficient input validation and sanitization at the storage layer, allowing malicious content to persist in the database where it could be exploited if CSP enforcement is weakened or if alternative rendering contexts bypass the CSP restrictions.

RemediationAI

Upgrade Zammad to version 7.0.1 or 6.5.4 or later, which include corrected HTML sanitization logic for ticket articles. Organizations unable to upgrade immediately should apply the Content Security Policy as a temporary mitigation, ensuring that script-src, object-src, and data URI policies are strictly enforced (the existing CSP in current Zammad deployments should already provide some protection). Administrators should audit existing ticket articles for suspicious data URI patterns or JavaScript in article content using database queries to identify any injected payloads. The official advisory and patch information are available at https://github.com/zammad/zammad/security/advisories/GHSA-c2cf-9fc7-jhf3.