CVE-2026-34718: Zammad Helpdesk XSS Vulnerability

CVE-2026-34718 Overview

CVE-2026-34718 is an HTML sanitization bypass vulnerability affecting Zammad, a web-based open source helpdesk and customer support system. Prior to versions 7.0.1 and 6.5.4, the HTML sanitizer for ticket articles failed to properly sanitize data: URI schemes, allowing malicious content to be stored in the Zammad instance database. While the Zammad GUI renders this content, applied Content Security Policy (CSP) rules prevented immediate exploitation through link clicks. This vulnerability is classified as CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page).

Critical Impact

Attackers can inject malicious data URI schemes into ticket articles that persist in the database, potentially enabling stored XSS attacks if CSP protections are weakened or bypassed in the future.

Affected Products

• Zammad versions prior to 7.0.1
• Zammad versions prior to 6.5.4
• Zammad helpdesk/customer support system installations using vulnerable HTML sanitization

Discovery Timeline

• April 8, 2026 - CVE-2026-34718 published to NVD
• April 8, 2026 - Last updated in NVD database

Technical Details for CVE-2026-34718

Vulnerability Analysis

This vulnerability stems from incomplete input sanitization in Zammad's HTML processing pipeline for ticket articles. The HTML sanitizer component is responsible for stripping potentially dangerous content from user-submitted ticket articles before storing them in the database. However, the sanitizer failed to account for data: URI schemes, which can embed arbitrary content including potentially malicious scripts directly within HTML attributes.

When a user creates or updates a ticket article containing a data: URI, the content passes through the sanitizer without proper neutralization. The malicious payload is then persisted in the Zammad database and rendered to any user viewing the affected ticket. The vulnerability's impact is partially mitigated by Zammad's Content Security Policy implementation, which prevents inline script execution in compliant browsers.

Root Cause

The root cause is an incomplete allowlist or blocklist implementation in the HTML sanitization logic. The sanitizer did not include data: URI schemes in its dangerous protocol detection, allowing these URIs to bypass validation. This represents a classic case of CWE-80 where script-related HTML content is not properly neutralized before being rendered in web pages.

Attack Vector

The attack vector is network-based, requiring an attacker to submit a crafted ticket article containing malicious data: URI schemes. The attack flow involves:

1. An attacker crafts a ticket article containing a data: URI with embedded malicious content (e.g., data:text/html,<script>...</script> or similar payloads)
2. The vulnerable HTML sanitizer fails to detect and remove the data: URI scheme
3. The malicious content is stored in the Zammad database
4. When other users (including support staff or administrators) view the ticket, the malicious content is rendered in their browser
5. While CSP rules currently prevent script execution, the stored payload could be exploited if CSP configurations change or through other attack chains

The vulnerability requires passive user interaction (viewing the affected ticket article) for potential exploitation. For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-34718

Indicators of Compromise

• Ticket articles containing data: URI schemes in href attributes or other HTML elements
• Database entries with embedded data:text/html or data:application/javascript content
• Unusual ticket content patterns that include base64-encoded payloads within data URIs
• CSP violation reports indicating blocked inline script execution attempts

Detection Strategies

• Implement database queries to scan existing ticket articles for data: URI patterns
• Enable and monitor Content Security Policy violation reporting to detect exploitation attempts
• Deploy web application firewall rules to detect and block submissions containing suspicious data URI schemes
• Conduct periodic security audits of ticket article content for anomalous patterns

Monitoring Recommendations

• Enable verbose logging for ticket article creation and modification events
• Configure alerting on CSP violations that may indicate exploitation attempts
• Monitor for unusual patterns in user-submitted ticket content
• Review web server access logs for requests containing data URI patterns in POST data

How to Mitigate CVE-2026-34718

Immediate Actions Required

• Upgrade Zammad installations to version 7.0.1 or 6.5.4 immediately
• Review existing ticket articles in the database for potentially malicious data URI content
• Ensure Content Security Policy headers remain properly configured as a defense-in-depth measure
• Consider temporarily restricting ticket article HTML capabilities until patching is complete

Patch Information

Zammad has released security patches addressing this vulnerability. Organizations should upgrade to:

• Version 7.0.1 for installations running the 7.x branch
• Version 6.5.4 for installations running the 6.x branch

The patches enhance the HTML sanitizer to properly detect and neutralize data: URI schemes before content is stored in the database. For complete patch details and upgrade instructions, refer to the GitHub Security Advisory.

Workarounds

• Maintain strict Content Security Policy configurations to prevent script execution from injected content
• Implement additional web application firewall rules to filter data URI schemes from incoming requests
• Restrict HTML input capabilities in ticket articles to plain text where business requirements permit
• Conduct a database audit to identify and sanitize any existing malicious content stored prior to patching

# Example: Database query to identify potentially affected content (PostgreSQL)
# Consult Zammad documentation for exact table structure
psql -d zammad_production -c "SELECT id, ticket_id FROM ticket_articles WHERE body LIKE '%data:%' OR body LIKE '%data:%';"