Zammad EUVD-2026-87245

Requires an authenticated Zammad administrator with permission to create or edit AI Agents, and the Zammad AI Agent feature must be in use so that an agent processes tickets. The attacker enters a specially crafted value containing a nested ERB opener (e.g. <%<%= ... %>) into an AI Agent field; because the pre-7.1.2 sanitizer used Ruby .sub and escaped only the first <% occurrence, the smuggled inner tag survives and executes when the agent next processes a ticket - no interaction from any other user is needed. Limiting factors: the high privilege requirement (admin-level AI Agent management), dependence on the optional AI Agent feature being configured, and the affected version being prior to 7.1.2. This is a privileged-configuration flaw, not a default-config unauthenticated exploit.

This is a genuine remote code execution flaw, not a mislabeled DoS - the RCE tag and CVSS 4.0 impact metrics (VC:H/VI:H/VA:H) are accurate and corroborated by the fix commit, which patches an ERB (embedded Ruby) template-injection primitive in lib/erb_sanitizer.rb. The critical mitigating signal is PR:H: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) and the description agree that exploitation requires an administrator already holding permission to create or edit AI Agents, so this is a privileged-insider / post-compromise-admin escalation to host command execution, not an unauthenticated internet-facing exploit. There is no EPSS score, no CISA KEV listing, and no packaged public exploit at time of analysis - so exploitation status is 'no public exploit identified' - however the fix commit's added spec cases publicly disclose the exact bypass payload (<%<%= 1 + 1 %>), lowering the bar to weaponization. Net: high CVSS but real-world priority is tempered by the admin prerequisite and niche deployment; treat as a patch-promptly item for Zammad operators using AI Agents rather than an emergency internet-wide threat. Note the CWE-20 (Improper Input Validation) label understates the issue - the true weakness is code/template injection (CWE-94/CWE-1336); verify categorization with the vendor advisory.

An administrator (or an attacker who has phished/compromised an admin account) with AI-Agent edit rights enters a crafted field value such as <%<%= system('...') %> into an AI Agent configuration. The legacy sanitizer escaped only the first <% (using Ruby's .sub), leaving the nested inner ERB tag live, so the next time that AI Agent processes a ticket the Ruby code executes automatically on the Zammad host with no other user interaction. No standalone weaponized POC is published, but the patch commit's test payloads reveal the working bypass technique.