OTRS GmbH up to 2026.X Send Support Bundle SendSupportBundle path traversal

Summaryinfo

A vulnerability was found in OTRS GmbH OTRS up to 2026.X. It has been classified as problematic. The impacted element is the function SendSupportBundle of the component Send Support Bundle. Performing a manipulation results in path traversal. This vulnerability is identified as CVE-2026-78355. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in OTRS GmbH OTRS up to 2026.X. It has been classified as problematic. This affects the function SendSupportBundle of the component Send Support Bundle. The manipulation with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on integrity, and availability. The summary by CVE is:

A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory. This may allow files accessible to the OTRS application process to be deleted. The vulnerability does not bypass operating system file permissions. On OTRS versions prior to OTRS 7, the effective permissions of the web server process are relevant. Starting with OTRS 7, access is limited by the permissions of the dedicated OTRS user. Files with overly permissive ownership or file system permissions may therefore also be affected. The affected functionality may additionally attempt to include controlled files in a support bundle. However, support bundles are sent to a predefined OTRS support address, and direct disclosure of arbitrary files to the attacker has not been demonstrated. An attacker therefore requires valid administrative access to exploit the vulnerable functionality. The primary demonstrated impact is the deletion of files outside the intended directory within the effective permissions of the OTRS application process. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected

The advisory is shared at otrs.com. This vulnerability is uniquely identified as CVE-2026-78355 since 08/24/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. The exploitation needs additional levels of successful authentication. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

Upgrading to version 2026.7.X eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-3872). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• OTRS OTRS

Productinfo

Type

• Service Management Software

Vendor

• OTRS GmbH

Name

• OTRS

Version

• 6.x
• 7.0.X
• 8.0.X
• 2023.X
• 2024.X
• 2025.X
• 2026.X

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion