CVE-2026-78355

Name of the Vulnerable Software and Affected Versions OTRS versions 6.x and earlier OTRS versions 7.0.x through 2026.6.x

Description A path traversal issue in the SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory. This can lead to the deletion of files accessible to the OTRS application process, provided they have overly permissive ownership or file system permissions. The issue does not bypass operating system file permissions; for versions prior to OTRS 7, the web server process permissions apply, while OTRS 7 and later are limited by the dedicated OTRS user permissions. Additionally, the functionality may attempt to include controlled files in a support bundle, although these bundles are sent to a predefined support address.

Recommendations Update OTRS versions 6.x and earlier to a patched version. Update OTRS versions 7.0.x through 2026.6.x to version 2026.7.x or later.