# CVE-2026-48212: OTRS stored cross-site scripting in Custom Page

Source: https://junglewise.ai/threats/cve-2026-48212-an-otrs-administrator-can-enter-arbitrary-javascript-into-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-48212 · Severity: medium · CVSS 4.8 · Published 2026-10-12

OTRS is a service management platform used by organizations to manage support tickets and internal IT services. An administrator with privileged access can inject arbitrary JavaScript code into custom pages, which is then executed in the browsers of all users who access those pages. This could allow an attacker with admin access to steal user session tokens, capture credentials, or perform actions on behalf of users.

Technologies: [Otrs](https://junglewise.ai/threats/technologies/otrs). Vendors: [Otrs](https://junglewise.ai/threats/vendors/otrs).

## Quick answers

**Is CVE-2026-48212 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48212 being exploited in the wild.

**How severe is CVE-2026-48212?** Medium severity, with a CVSS score of 4.8, published 12 October 2026.

**Which products and versions are affected?** Otrs 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, 2026.X before 2026.7.X.

**Is there a fix for CVE-2026-48212?** Yes: fixed in OTRS 2026.7.X and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48212 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-48212?** Check whether you run Otrs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in OTRS 2026.7.X and later

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in OTRS's Custom Page feature where administrator input is not properly sanitized before being stored and rendered. An authenticated administrator can insert malicious JavaScript that persists in the application and executes client-side in users' browsers without additional authentication or user interaction required. The vulnerability affects multiple major versions and requires administrative privileges to exploit.

## Affected products

- OTRS OTRS 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, 2026.X before 2026.7.X

## Timeline

- 2026-10-12: disclosed

## References

- [https://otrs.com/release-notes/otrs-security-advisory-2026-11/](https://otrs.com/release-notes/otrs-security-advisory-2026-11/)

## Related threats

- [OTRS CSV injection via formula characters in user-controlled values](https://junglewise.ai/threats/cve-2026-93581-user-controlled-values-are-not-sufficiently-neutralized-when)
- [OTRS insufficient customer user identity uniqueness enforcement](https://junglewise.ai/threats/cve-2026-78359-otrs-does-not-sufficiently-enforce-the-uniqueness-of-customer)
- [OTRS cross-site request forgery in administrative actions](https://junglewise.ai/threats/cve-2026-78358-several-administrative-actions-do-not-sufficiently-validate)
- [OTRS authentication token invalidation delay on account deactivation](https://junglewise.ai/threats/cve-2026-78357-previously-issued-authentication-tokens-are-not-immediately)
- [OTRS Agent Frontend authentication bypass in configuration endpoint](https://junglewise.ai/threats/cve-2026-78356-the-otrs-agent-frontend-configuration-endpoint-can-be-accessed)