Server-Side Template Injection to RCE in Zammad's AI Agent (CVE-2026-34724)
How Zammad’s brand-new AI Agent feature routed admin-controlled input into an ERB template rendered with trusted: true, yielding remote code execution as the application user.