PT-2026-110486

CVE-2026-48212

·

Published

2026-10-12

·

Updated

2026-10-15

Description by

CVSS 3.1
4.8
Medium
MetricsAV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions OTRS versions 7.0.X OTRS versions 8.0.X OTRS versions 2023.X OTRS versions 2024.X OTRS versions 2025.X OTRS versions prior to 2026.7.X
Description An administrator can inject arbitrary JavaScript into the content of a Custom Page. This script is stored by the application and executed in the browser of any user who accesses that page, leading to a stored cross-site scripting (XSS) condition.
Recommendations Update OTRS version 7.0.X to a fixed version. Update OTRS version 8.0.X to a fixed version. Update OTRS version 2023.X to a fixed version. Update OTRS version 2024.X to a fixed version. Update OTRS version 2025.X to a fixed version. Update OTRS to version 2026.7.X or later.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')
Related identifiers
CVE-2026-48212
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com