CVE-2026-56735 Overview
CVE-2026-56735 affects Zammad, a web-based open source helpdesk and customer support system. The vulnerability resides in the HtmlSanitizer::Strict component, which blocks external URLs in image tags to prevent remote content loading. However, the srcset attribute was allowlisted without the same validation check. Attackers can embed arbitrary external URLs in the srcset attribute by sending a crafted email. When an agent views the ticket, the browser silently fetches the attacker-controlled URL, leaking the agent's IP address, User-Agent, Referer header, and ticket view timestamp. The flaw is tracked under CWE-82: Improper Neutralization of Script in Attributes of IMG Tags.
Critical Impact
Unauthenticated attackers can track Zammad agents and harvest client metadata simply by sending an email, bypassing the external content protection intended to block tracking pixels.
Affected Products
- Zammad versions prior to 7.0.2
- Zammad versions prior to 7.1.0
- Zammad HtmlSanitizer::Strict sanitization component
Discovery Timeline
- 2026-09-25 - CVE-2026-56735 published to NVD
- 2026-09-28 - Last updated in NVD database
Technical Details for CVE-2026-56735
Vulnerability Analysis
Zammad's HtmlSanitizer::Strict module enforces an allowlist for HTML content rendered inside tickets. For <img> tags, the sanitizer inspects the src attribute and blocks any external URL to prevent remote content from loading inside the agent's browser. This protection is designed to defeat tracking pixels and preserve agent privacy.
The srcset attribute was added to the allowlist for <img> tags but was not routed through the same external-URL check. The srcset attribute instructs modern browsers to fetch one of several candidate image sources based on device characteristics. Any URL placed inside srcset is treated as an authoritative image source by the browser.
When an attacker embeds a malicious srcset value in an inbound email, Zammad stores the sanitized HTML with the srcset attribute intact. The moment a support agent opens the ticket, the browser issues an HTTP GET request to the attacker-controlled endpoint. The resulting request discloses the agent's public IP address, the User-Agent string identifying browser and operating system, the Zammad Referer URL, and the exact ticket-view timestamp.
Root Cause
The root cause is an incomplete allowlist filter in HtmlSanitizer::Strict. The sanitizer applied external-URL validation only to the src attribute of image tags, leaving the equally dangerous srcset attribute unchecked. This is a classic input validation gap where a protection control covers one code path but omits a functionally equivalent sibling attribute.
Attack Vector
Exploitation requires no authentication. An attacker emails a Zammad instance with an HTML message containing an <img> tag whose srcset attribute references an attacker-controlled URL. The email is ingested into a ticket. When any agent later views that ticket, the browser automatically resolves the srcset candidate and discloses client metadata to the attacker's server. The vulnerability requires user interaction (an agent opening the ticket) but no further action.
The vulnerability mechanism is described in the Zammad GitHub Security Advisory GHSA-7fwx-3xr4-qm6w and the upstream commit 02c1ff8.
Detection Methods for CVE-2026-56735
Indicators of Compromise
- Inbound email messages containing <img> tags with srcset attributes pointing to external, non-trusted domains.
- Outbound HTTP(S) requests from agent workstations to unknown hosts with a Referer header pointing at the Zammad ticket interface.
- Repeated image-content requests to the same external domain shortly after agents open specific tickets.
Detection Strategies
- Inspect stored ticket HTML in the Zammad database for srcset attributes referencing external URLs.
- Correlate ticket-view audit logs with proxy or firewall logs to identify callbacks triggered by email rendering.
- Deploy email security filtering that rewrites or strips srcset attributes on inbound mail destined for the helpdesk mailbox.
Monitoring Recommendations
- Monitor the Zammad application version and alert on instances running below 7.0.2 or 7.1.0.
- Log all outbound HTTP requests originating from browsers rendering helpdesk content, with alerting on first-seen external domains.
- Track inbound mail with high-entropy or newly registered domains referenced in HTML image attributes.
How to Mitigate CVE-2026-56735
Immediate Actions Required
- Upgrade Zammad to version 7.0.2 on the 7.0.x branch or 7.1.0 on the 7.1.x branch.
- Audit existing tickets for srcset attributes referencing external hosts and sanitize or redact affected content.
- Instruct agents to use browsers configured to block third-party image loading until patching is complete.
Patch Information
The fix extends HtmlSanitizer::Strict to apply the same external-URL block to the srcset attribute of <img> tags that it already applied to src. The patch is available in Zammad 7.0.2 and Zammad 7.1.0. Review the upstream commit 02c1ff8 for the sanitizer changes.
Workarounds
- Enforce an outbound web proxy policy that blocks browser-initiated requests from the helpdesk subnet to untrusted domains.
- Configure a Content Security Policy (CSP) with img-src restrictions to prevent image loading from arbitrary external hosts.
- Pre-process inbound email HTML with an upstream sanitizer that removes the srcset attribute from all image tags.
# Example CSP header restricting image sources to the helpdesk origin
Content-Security-Policy: default-src 'self'; img-src 'self' data:; connect-src 'self'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
