CVE-2026-78355— Path Traversal in SendSupportBundle allows File Deletion Outside the Intended Directory
Quick assessment
Affected
OTRS GmbH (former OTRS AG) OTRS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
OTRS 的 SendSupportBundle（发送支持包）功能中存在路径遍历漏洞，允许经过身份验证的管理员引用预期目录之外的文件路径。 该漏洞可能导致 OTRS 应用程序进程有权访问的文件被删除。此漏洞不会绕过操作系统文件权限。在 OTRS 7 之前的版本中，Web 服务器进程的有效权限相关；从 OTRS 7 开始，访问权限由专用的 OTRS 用户的权限进行限制。因此，拥有过于宽松的所有权或文件系统权限的文件也可能受到此漏洞影响。 受影响的功能还可能尝试将受控文件包含在支持包中。然而，支持包会被发送至预定义的
Possible ATT&CK Techniques 2 AI
T1083 · File and Directory Discovery T1530 · Data from Cloud StorageAffected Version Matrix 7
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| OTRS GmbH (former OTRS AG) | ((OTRS)) Community Edition | 6.x |
affected |
| OTRS GmbH (former OTRS AG) | OTRS | 7.0.x |
affected |
8.0.x |
affected | ||
2023.x |
affected | ||
2024.x |
affected | ||
2025.x |
affected | ||
2026.x≤ 2026.6.x |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-78355
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Path Traversal in SendSupportBundle allows File Deletion Outside the Intended Directory
Source: CVE Program / CVE List V5
Vulnerability Description
A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory.
This may allow files accessible to the OTRS application process to be deleted. The vulnerability does not bypass operating system file permissions. On OTRS versions prior to OTRS 7, the effective permissions of the web server process are relevant. Starting with OTRS 7, access is limited by the permissions of the dedicated OTRS user. Files with overly permissive ownership or file system permissions may therefore also be affected.
The affected functionality may additionally attempt to include controlled files in a support bundle. However, support bundles are sent to a predefined OTRS support address, and direct disclosure of arbitrary files to the attacker has not been demonstrated.
An attacker therefore requires valid administrative access to exploit the vulnerable functionality. The primary demonstrated impact is the deletion of files outside the intended directory within the effective permissions of the OTRS application process.
This issue affects OTRS:
* 7.0.X
* 8.0.X
* 2023.X
* 2024.X
* 2025.X
* 2026.X before 2026.7.X
Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| OTRS GmbH (former OTRS AG) | OTRS | 7.0.x | - |
|
| OTRS GmbH (former OTRS AG) | ((OTRS)) Community Edition | 6.x | - |
|
II. Public POCs for CVE-2026-78355
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-78355
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-78355 (1)
Same Patch Batch · OTRS GmbH (former OTRS AG) · 2026-10-12 · 9 CVEs total
| CVE-2026-93582 | 9.4 CRITICAL | Authentication Bypass via Spoofed Remote-User Header in HTTP Basic Authentication |
| CVE-2026-78357 | 9.1 CRITICAL | Insufficient Session Revocation for JWT Authentication |
| CVE-2026-93581 | 6.1 MEDIUM | Insufficient Neutralization of Formula Elements in CSV Exports |
| CVE-2026-48211 | 5.4 MEDIUM | Cross-Site Request Forgery in Import/Export Admin console |
| CVE-2026-78359 | 5.4 MEDIUM | Duplicate Identity / Identity Shadowing across CustomerUser backends |
| CVE-2026-78356 | 5.3 MEDIUM | Unauthenticated Disclosure of Agent Frontend Configuration |
| CVE-2026-48212 | 4.8 MEDIUM | Stored XSS in external pages |
| CVE-2026-78358 | 4.3 MEDIUM | Cross-Site Request Forgery in Administrative Actions |
IV. Related Vulnerabilities
Same product: OTRS
-
CVE-2026-93582
Authentication Bypass via Spoofed Remote-User Header in HTTP -
CVE-2026-93581
Insufficient Neutralization of Formula Elements in CSV Expor -
CVE-2026-78359
Duplicate Identity / Identity Shadowing across CustomerUser -
CVE-2026-78358
Cross-Site Request Forgery in Administrative Actions -
CVE-2026-78357
Insufficient Session Revocation for JWT Authentication
Same vendor: OTRS GmbH (former OTRS AG)
-
CVE-2026-93582
Authentication Bypass via Spoofed Remote-User Header in HTTP -
CVE-2026-93581
Insufficient Neutralization of Formula Elements in CSV Expor -
CVE-2026-78359
Duplicate Identity / Identity Shadowing across CustomerUser -
CVE-2026-78358
Cross-Site Request Forgery in Administrative Actions -
CVE-2026-78357
Insufficient Session Revocation for JWT Authentication
Same weakness: CWE-22
-
CVE-2026-108452
Microsoft Office SharePoint Remote Code Execution Vulnerabil -
CVE-2026-111170
kedro-datasets 9.3.0 through 9.6.0 Path Traversal via Matplo -
CVE-2026-57496
NetLicensing MCP Server: REST Path Traversal Bypasses Token -
CVE-2026-61702
OpenPrinting CUPS: root-side banner file disclosure -
CVE-2026-62679
Lychee: Path traversal in `SecurePathController` allows auth
V. Comments for CVE-2026-78355
No comments yet