https://cti.al/tags/zammad/Recent content in Zammad on cti.alHugoen-usWed, 03 Jun 2026 12:00:00 +0200https://cti.al/posts/zammad-ssti-rce-ai-agent-cve-2026-34724/Wed, 03 Jun 2026 12:00:00 +0200https://cti.al/posts/zammad-ssti-rce-ai-agent-cve-2026-34724/A new AI Agent feature in Zammad 7.0 splices admin-controlled enrichment values straight into an ERB template rendered with trusted: true — reaching a code-execution sink that dates back to a 2021 CVE.https://cti.al/posts/zammad-ssrf-webhooks-cve-2026-34719/Wed, 03 Jun 2026 11:00:00 +0200https://cti.al/posts/zammad-ssrf-webhooks-cve-2026-34719/Zammad's webhook endpoint validation checked only scheme and hostname — never the resolved IP — so a webhook could be pointed straight at loopback, RFC 1918, or the cloud metadata service, and the response read back from the HTTP logs.https://cti.al/posts/zammad-data-uri-xss-cve-2026-34718/Wed, 03 Jun 2026 10:00:00 +0200https://cti.al/posts/zammad-data-uri-xss-cve-2026-34718/Zammad's HTML sanitizer stripped javascript:, livescript: and vbscript: from links — but not data:. A data:text/html anchor survived sanitization and was stored verbatim in ticket articles.