CVE-2026-34718

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-34718

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34718.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-34718

Aliases

GHSA-c2cf-9fc7-jhf3

Published

2026-04-08T18:01:20.870Z

Modified

2026-07-27T03:56:37.979914478Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Zammad improperly neutralizes of script-related HTML tags in ticket articles

Details

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the HTML sanitizer for ticket articles was missing proper sanitization of data: ... URI schemes, resulting in storing such malicious content in the database of the Zammad instance. The Zammad GUI is rendering this content, due to applied CSP rules no harm was done by e.g., clicking such a link. This vulnerability is fixed in 7.0.1 and 6.5.4.

Database specific

{
    "cwe_ids": [
        "CWE-80"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34718.json"
}

References

Affected packages

Git / github.com/zammad/zammad

Affected ranges

Type

GIT

Repo

https://github.com/zammad/zammad

Events

Introduced

Fixed

15c7e6d4ffd95c84535d334b7c0ce0bc2fbc5228

Introduced

f3228274c4feefac470d7efad12f240debd678bc

Last affected

f3228274c4feefac470d7efad12f240debd678bc

Database specific

{
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "cpe": [
        "cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:zammad:zammad:7.0.0:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.5.4"
        },
        {
            "introduced": "7.0.0"
        },
        {
            "last_affected": "7.0.0"
        }
    ]
}

Affected versions

1.*

1.6.0

3.*

3.7.0

5.*

5.2.0-alpha

5.3.0-alpha

5.4.0-alpha

5.5.0-alpha

6.*

6.0.0-alpha

6.1.0-alpha

6.2.0-alpha

6.3.0-alpha

6.4.0-alpha

6.5.0

6.5.0-alpha

6.5.1

6.5.2

6.5.3

7.*

7.0.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34718.json"