CVE-2026-53804

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-53804

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53804.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-53804

Published

2026-08-20T21:13:24Z

Modified

2026-08-23T03:42:55Z

Severity

8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

OTRS Community Edition OS Command Injection via PGP Configuration

Details

OTRS Community Edition contains an authenticated OS command injection vulnerability in the PGP encryption module that allows administrators to execute arbitrary operating-system commands by supplying crafted values for the PGP binary path and command options. Administrator-supplied configuration values are concatenated without sanitization into a shell command, enabling arbitrary command execution as the web server process user during normal ticket operations after the malicious configuration is deployed.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53804.json"
}

References

Affected packages

Git / github.com/centuran/otrs-community-edition

Affected ranges

Type

GIT

Repo

https://github.com/centuran/otrs-community-edition

Events

Introduced

Last Affected

0a674ad2fa8c61c889e708437432cfb1473c74cf

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "6.0.41"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v6.*

v6.0.32

v6.0.33

v6.0.37

v6.0.38

v6.0.39

v6.0.40

v6.0.41

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53804.json"