Is CVE-2025-52204 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-52204 being exploited in the wild.

How severe is CVE-2025-52204?

Medium severity, with a CVSS score of 6.1, published 23 March 2026.

Which products and versions are affected?

Znuny 6.5.9 - 6.5.18; Znuny LTS 6.5.9 - 6.5.18.

Is there a fix for CVE-2025-52204?

A patch was published on 2026-03-25: Znuny 7.3.1 and LTS 6.5.19 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-52204 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2025-52204?

Check whether you run Znuny or Znuny LTS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-52204: Znuny reflected XSS in customer.pl OTRSCustomerInterface parameter

CVE-2025-52204 · Severity: medium · CVSS 6.1 · Published 2026-03-23

Znuny, a popular open-source help desk and ticketing system, is vulnerable to a security flaw in its customer portal. An attacker can send a specially crafted link to a user; if clicked, the attacker can run malicious scripts in the user's browser. This could lead to unauthorized actions being performed on the user's behalf, the theft of login information, or the display of deceptive content to trick customers.

Technologies: Znuny, Znuny LTS. Vendors: Znuny.

Quick answers

Is CVE-2025-52204 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-52204 being exploited in the wild.
How severe is CVE-2025-52204?: Medium severity, with a CVSS score of 6.1, published 23 March 2026.
Which products and versions are affected?: Znuny 6.5.9 - 6.5.18; Znuny LTS 6.5.9 - 6.5.18.
Is there a fix for CVE-2025-52204?: A patch was published on 2026-03-25: Znuny 7.3.1 and LTS 6.5.19 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-52204 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2025-52204?: Check whether you run Znuny or Znuny LTS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A reflected Cross-Site Scripting (XSS) and HTML injection vulnerability exists in Znuny's customer.pl endpoint. The vulnerability is rooted in the improper neutralization of input provided via the OTRSCustomerInterface parameter (or the parameter defined by CustomerPanelSessionName in the system configuration). An unauthenticated remote attacker can exploit this by tricking a user into clicking a crafted GET request, allowing the execution of arbitrary JavaScript or the injection of malicious HTML within the context of the victim's browser session. The issue affects both the 6.5.x LTS branch and the 7.x branch. The vendor has released patches in Znuny LTS 6.5.19 and Znuny 7.3.1.

Affected products

Znuny Znuny LTS 6.5.9 - 6.5.18
Znuny Znuny 7.0.11 - 7.2.3

Timeline

2026-03-23: disclosed
2026-03-25: patched: Znuny 7.3.1 and LTS 6.5.19 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.