VulnSocial

CVE-2026-34718Disclosure(zammad / zammad)

LOWCVSS 6.1 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the HTML sanitizer for ticket articles was missing proper sanitization of data: ... URI schemes, resulting in storing such malicious content in the database of the Zammad instance. The Zammad GUI is rendering this content, due to applied CSP rules no harm was done by e.g., clicking such a link. This vulnerability is fixed in 7.0.1 and 6.5.4.

zammad CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-80

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • zammad

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-04-08); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
zammad
Products
zammad

1 version affected across 1 product

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-04-08: 1Mentions · 2026-04-09: 1Technical Details · 2026-04-08: 1Technical Details · 2026-04-09: 104-0804-09
Signal classification2 categories
Disclosure
150.0%
General
150.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-04-081
Disclosure1
2026-04-091
General1
Full discourse2 posts
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-34718 HTML Sanitization Vulnerability in Zammad Prior to 7.0.1 and 6.5.... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-34718 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1

    Post summary

    The post alerts to CVE-2026-34718 with a link to details and subscription option, providing only basic technical info but no PoC, exploit, patch, or active exploitation claim.

    0000050
    4.0K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-34718 Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the HTML sanitizer for ticket articles was missing proper sanitization o… https://www.cve.org/CVERecord?id=CVE-2026-34718

    Post summary

    The post announces CVE-2026-34718, noting a missing sanitization in Zammad's HTML sanitizer affecting versions before 7.0.1 and 6.5.4, with details available on CVE.org.

    00000102
    57.0K followersView on X
CPE platform detail2 entries

2 of 2 entries

PartVendorProductVersionTarget SWTarget HW
Appzammadzammad---
Appzammadzammad7.0.0--

Explore more

Back to dashboardzammad CVEszammad vulnerabilities