CVE-2026-63206: Zammad HTML Sanitizer XSS Vulnerability

CVE-2026-63206 Overview

Zammad is a web-based open source helpdesk and customer support system. A flaw in its HTML sanitizer allows attackers to bypass the remote image blocking protection in ticket articles and email views. The sanitizer fails to detect URLs that use a shortened scheme format omitting the double slash after the colon (for example http:example.com/image.png). Modern browsers treat the shortened form as equivalent to a standard remote URL and silently fetch the resource.

An attacker can send a crafted email or ticket containing such an image reference. When a recipient opens the ticket, their browser loads the external image without triggering Zammad's "remote content blocked" warning, disclosing read timestamps and viewer identity to the attacker.

Critical Impact
The bypass enables tracking pixels inside Zammad tickets, leaking when and by whom a ticket was opened without any user warning.

Affected Products

Zammad versions prior to 7.1.2
Zammad helpdesk and customer support deployments rendering HTML email content
Any Zammad instance relying on the built-in HTML sanitizer to block remote images

Discovery Timeline

2026-09-25 - CVE CVE-2026-63206 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-63206

Vulnerability Analysis

The vulnerability is an input validation failure [CWE-20] in Zammad's HTML sanitizer, specifically the remote_url? method in lib/html_sanitizer/scrubber/wipe.rb. The method identifies remote URLs by checking whether a string begins with http://, https://, ftp://, or //. This check misses the legacy shortened form where the double slash is omitted, such as http:example.com/tracker.gif.

Browsers follow RFC 3986 parsing behavior and resolve http:example.com as a valid remote resource. Because the sanitizer treats such strings as non-remote, it neither blocks the image nor renders the "remote content blocked" warning. The practical effect is a tracking pixel capability inside a helpdesk workflow where users expect remote content to be suppressed by default.

Root Cause

The scheme check used strict prefix matching that required :// after the protocol name. Shortened scheme URLs (scheme: without //) are valid in browsers but were not enumerated in the sanitizer's blocklist, allowing them to pass through unmodified.

Attack Vector

An unauthenticated attacker sends an email or creates a ticket containing an HTML img tag whose src attribute uses a shortened scheme pointing to attacker-controlled infrastructure. When an agent opens the article in the Zammad web UI, the browser issues the HTTP request, revealing viewer IP address, user agent, and open time to the attacker. Exploitation requires the victim to view the article (user interaction).

ruby

# Patch excerpt from lib/html_sanitizer/scrubber/wipe.rb
      end

      def remote_url?(string)
-        string.downcase.start_with?('http://', 'https://', 'ftp://', '//')
+        string.downcase.start_with?('http:', 'https:', 'ftp:', '//')
      end

      def unsafe_api_path?(string)

Source: Zammad commit a5878f3. The fix broadens the prefix match to the scheme and colon only, covering both http:// and http: forms.

Detection Methods for CVE-2026-63206

Indicators of Compromise

Inbound email or ticket content containing img tags with src values beginning with http: or https: immediately followed by a hostname rather than //.
Outbound HTTP(S) requests from agent workstations to unfamiliar domains correlated with ticket-view activity in Zammad logs.
Repeated image fetches to the same external host from multiple agents reviewing the same ticket thread.

Detection Strategies

Scan the Zammad database ticket_article HTML bodies for regex patterns matching shortened scheme URLs such as src\s*=\s*["']https?:[^/].
Inspect reverse proxy and web gateway logs for GET requests originating from the Zammad web UI session cookies toward low-reputation domains.
Correlate ticket open events with egress DNS lookups to detect tracking pixel beacons.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting on the Zammad front end to surface unexpected image loads to third-party origins.
Forward web proxy telemetry and Zammad application logs to a central analytics platform for correlation of ticket-view and outbound-fetch events.
Alert on new external hostnames referenced in incoming ticket HTML that match tracking pixel heuristics.

How to Mitigate CVE-2026-63206

Immediate Actions Required

Upgrade Zammad to version 7.1.2 or later, which contains the sanitizer fix from commit a5878f3.
Audit recent ticket articles for img tags using shortened scheme URLs and purge or quarantine suspicious entries.
Review access logs on agent workstations for connections to attacker infrastructure identified during audit.

Patch Information

The issue is resolved in Zammad 7.1.2. The fix updates remote_url? in lib/html_sanitizer/scrubber/wipe.rb to match on the scheme and colon prefix (http:, https:, ftp:), covering both standard and shortened URL forms. See the Zammad security advisory GHSA-fpwp-w2p4-hqg7 and the upstream commit for details.

Workarounds

Deploy a Content Security Policy restricting img-src to trusted origins to prevent unintended remote image loads.
Terminate inbound email at a gateway that rewrites or strips img tags with external src attributes before delivery to Zammad.
Instruct agents to view ticket articles in plain-text mode where possible until patching is complete.

bash

# Example nginx CSP header for the Zammad front end
add_header Content-Security-Policy "default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'" always;