Home

Description

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a server-side template injection vulnerability which leads to RCE via AI Agent exists. Impact is limited to environments where an attacker can control or influence type_enrichment_data (typically high-privilege administrative configuration). This vulnerability is fixed in 7.0.1.

PUBLISHED Reserved 2026-03-30 | Published 2026-04-08 | Updated 2026-04-09 | Assigner GitHub_M




HIGH: 8.7CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Problem types

CWE-94: Improper Control of Generation of Code ('Code Injection')

CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

Product status

>= 7.0.0, < 7.0.1
affected

References

github.com/...zammad/security/advisories/GHSA-fg9w-jg8f-4j94

cve.org (CVE-2026-34724)

nvd.nist.gov (CVE-2026-34724)

Download JSON