Path Traversal Vulnerability in OTRS Affects Multiple Versions
CVE-2026-78355

8.7HIGH

Key Information:

Vendor

Otrs Gmbh (former Otrs Ag)

Status
Otrs
((otrs)) Community Edition
Vendor
CVE Published:
12 October 2026

What is CVE-2026-78355?

A path traversal vulnerability exists in the SendSupportBundle functionality of OTRS, allowing an authenticated administrator to reference file paths outside of the specified directory. This could lead to unauthorized file deletions, albeit without bypassing operating system file permissions. While the risk is limited to affected files based on the web server's permissions prior to OTRS version 7, it's crucial for administrators to be aware of this vulnerability's implications. Versions 7.0.X, 8.0.X, and various upcoming editions are impacted, requiring immediate attention for proper access management and security posture. For OTRS Community Edition users on version 6.x or earlier, the likelihood of being affected is also high.

Affected Version(s)

((OTRS)) Community Edition 6.x

OTRS 7.0.x

OTRS 7.0.x

References

https://otrs.com/release-notes/otrs-security-advisory-202...

CVSS V3.1

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Special thanks to William Bastos (@chor4o) and Samara Gama (igobysamy) for reporting this vulnerability
.