# CVE-2026-78355: OTRS path traversal in SendSupportBundle

Source: https://junglewise.ai/threats/cve-2026-78355-a-path-traversal-vulnerability-in-the-otrs-sendsupportbundle  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-78355 · Severity: high · CVSS 8.7 · Published 2026-10-12

OTRS is a service desk and ticketing platform used to manage customer and IT support requests. A path traversal vulnerability in the SendSupportBundle functionality allows authenticated administrators to delete files outside the intended support directories by manipulating file paths. While file system permissions limit the damage, files with overly permissive settings or earlier OTRS versions (before version 7) running under web server accounts are at risk of unauthorized deletion.

Technologies: [Otrs](https://junglewise.ai/threats/technologies/otrs). Vendors: [Otrs](https://junglewise.ai/threats/vendors/otrs).

## Quick answers

**Is CVE-2026-78355 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78355 being exploited in the wild.

**How severe is CVE-2026-78355?** High severity, with a CVSS score of 8.7, published 12 October 2026.

**Which products and versions are affected?** Otrs 7.0.x, 8.0.x, 2023.x, 2024.x, 2025.x, 2026.x before 2026.7.x; Community Edition 6.x and earlier.

**Is there a fix for CVE-2026-78355?** Yes: fixed in OTRS 2026.7.x and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-78355 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-78355?** Check whether you run Otrs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in OTRS 2026.7.x and later

## Technical details

The vulnerability is a path traversal flaw in OTRS SendSupportBundle that permits authenticated administrators to reference and delete arbitrary files outside the intended directory. The attack requires valid administrative credentials and does not bypass OS-level file permissions; impact depends on the effective process permissions (web server user in OTRS 6.x and earlier, dedicated OTRS user in 7.x and later). The functionality may also attempt to include controlled files in support bundles sent to OTRS support, but direct file disclosure to the attacker has not been demonstrated.

## Affected products

- OTRS OTRS 7.0.x, 8.0.x, 2023.x, 2024.x, 2025.x, 2026.x before 2026.7.x; Community Edition 6.x and earlier

## Timeline

- 2026-10-12: disclosed

## References

- [https://otrs.com/release-notes/otrs-security-advisory-2026-12/](https://otrs.com/release-notes/otrs-security-advisory-2026-12/)

## Related threats

- [OTRS CSV injection via formula characters in user-controlled values](https://junglewise.ai/threats/cve-2026-93581-user-controlled-values-are-not-sufficiently-neutralized-when)
- [OTRS insufficient customer user identity uniqueness enforcement](https://junglewise.ai/threats/cve-2026-78359-otrs-does-not-sufficiently-enforce-the-uniqueness-of-customer)
- [OTRS cross-site request forgery in administrative actions](https://junglewise.ai/threats/cve-2026-78358-several-administrative-actions-do-not-sufficiently-validate)
- [OTRS authentication token invalidation delay on account deactivation](https://junglewise.ai/threats/cve-2026-78357-previously-issued-authentication-tokens-are-not-immediately)
- [OTRS Agent Frontend authentication bypass in configuration endpoint](https://junglewise.ai/threats/cve-2026-78356-the-otrs-agent-frontend-configuration-endpoint-can-be-accessed)