Quick answers
- Is CVE-2026-63006 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-63006 being exploited in the wild.
- How severe is CVE-2026-63006?
- Informational severity, published 25 September 2026.
- Which products and versions are affected?
- Zammad prior to 7.1.2.
- Is there a fix for CVE-2026-63006?
- A patch was published on 2026-09-25: version 7.1.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-63006 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-63006?
- Check whether you run Zammad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The HTML sanitizer in Zammad's image URL allowlist used insufficiently strict validation, allowing path traversal sequences (such as ../) to bypass protections. When an authenticated agent views content containing the crafted URL, the browser resolves it to a protected API endpoint and sends the request with the agent's session cookie, enabling CSRF-like side effects. The vulnerability requires no attacker privileges or user interaction beyond an agent viewing the malicious content; it is fixed in version 7.1.2.
Affected products
- Zammad Zammad prior to 7.1.2
Timeline
- 2026-09-25: disclosed
- 2026-09-25: patched: version 7.1.2