CVE-2026-78355 in OTRS
Summary
by MITRE • 10/12/2026
A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory.
This may allow files accessible to the OTRS application process to be deleted. The vulnerability does not bypass operating system file permissions. On OTRS versions prior to OTRS 7, the effective permissions of the web server process are relevant. Starting with OTRS 7, access is limited by the permissions of the dedicated OTRS user. Files with overly permissive ownership or file system permissions may therefore also be affected.
The affected functionality may additionally attempt to include controlled files in a support bundle. However, support bundles are sent to a predefined OTRS support address, and direct disclosure of arbitrary files to the attacker has not been demonstrated.
An attacker therefore requires valid administrative access to exploit the vulnerable functionality. The primary demonstrated impact is the deletion of files outside the intended directory within the effective permissions of the OTRS application process.
This issue affects OTRS:
* 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X
Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/12/2026
The identified vulnerability represents a critical path traversal flaw within the SendSupportBundle functionality of the OTRS ticketing system, classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. This security defect permits an authenticated administrator user to manipulate file paths in a manner that escapes the intended application directory structure. While the vulnerability does not allow for arbitrary code execution or direct data exfiltration through the support bundle mechanism, it facilitates unauthorized deletion of files located outside the designated scope. The attack vector requires valid administrative credentials, which significantly restricts the threat landscape to insider threats or compromised high-privilege accounts rather than unauthenticated remote attackers.
The operational impact is primarily characterized by the potential destruction of system-critical configuration files, logs, or application data residing on the server hosting OTRS. Because the vulnerability allows for file deletion beyond the web root or application base directory, an attacker with administrative access can target sensitive resources such as database connection configurations, SSL certificates, or other backend service files. The severity and scope of this impact are heavily dependent on the effective permissions assigned to the process running the OTRS application. In versions prior to OTRS 7, the web server user's permissions dictate which files can be deleted. Starting with OTRS version 7 and subsequent releases including the 2023 through 2026 series before patch level X, access is governed by a dedicated OTRS system user. Consequently, any file owned by or accessible to this specific service account becomes a potential target for deletion if its filesystem permissions are overly permissive.
From an industry standard perspective, this vulnerability aligns with ATT&CK technique T1070: Indicator Removal on Host, specifically the sub-technique of deleting files to hinder forensic analysis and recovery efforts. Although the primary intent may not be malicious obfuscation in all cases, the capability to remove arbitrary files within the process's permission scope poses a severe risk to system integrity and availability. The lack of demonstrated direct disclosure means that confidentiality is less immediately compromised than integrity and availability, yet the ability to delete critical infrastructure components can lead to service outages requiring manual intervention for restoration.
Mitigation strategies must focus on both software updates and operational hardening. Administrators should upgrade OTRS to version 2026.7.X or later where these path traversal constraints have been addressed in the codebase. For environments unable to immediately patch, strict adherence to the principle of least privilege is essential. The dedicated OTRS user account must be configured with minimal filesystem permissions, ensuring it only has read and write access to its own application directories and necessary configuration files. Regular audits of file ownership and permission settings across the server are recommended to identify any resources that may have been inadvertently granted excessive access rights to the service account. Additionally, implementing robust logging and monitoring for administrative actions involving bundle generation can aid in detecting potential exploitation attempts by compromised accounts.