CVE-2026-102345— Zammad: Stored XSS in ticket article rendering in the new Vue-based interface

Quick assessment

Affected

zammad zammad

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Zammad 是一个基于 Web 的开源工单与客户支持系统。在 7.1.2 版本之前，其基于 Vue 的新工单界面在渲染工单文章内容时，未能执行预期的输出编码。已认证用户可在工单文章中存储恶意标记（markup），当其他用户查看该工单时，这些标记会被解析执行，从而引发存储型跨站脚本攻击（Stored XSS）。默认的内容安全策略（CSP）在一定程度上限制了该漏洞的实际危害，且经典的 REST/CoffeeScript 界面不受此问题影响。该漏洞已在 7.1.2 版本中修复。

CVSS 5.1 · Medium Updated Nov 05, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
zammad	zammad	`< 7.1.2`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Zammad: Stored XSS in ticket article rendering in the new Vue-based interface

Source: CVE Program / CVE List V5

Vulnerability Description

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the new Vue-based ticket interface can render ticket article content without the expected output encoding. An authenticated user can store markup in an article that is interpreted when another user views the ticket, enabling stored cross-site scripting. The default Content Security Policy limits practical impact, and the classic REST/CoffeeScript interface is not affected. This issue is fixed in version 7.1.2.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
zammad	zammad	< 7.1.2	-

II. Public POCs for CVE-2026-102345

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-102345

请登录查看更多情报信息。

Other References for CVE-2026-102345 (2)

https://github.com/zammad/zammad/security/advisories/GHSA-4x3x-65c5-8hx4 x_refsource_CONFIRM
https://github.com/zammad/zammad/commit/fe8fb9bd6c61f9136c93ef00cc08904bca0edecc x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-102345

IV. Related Vulnerabilities

Same product: zammad

Same vendor: zammad

Same weakness: CWE-79