CVE-2026-53804

Name of the Vulnerable Software and Affected Versions OTRS Community Edition (affected versions not specified)

Description An authenticated OS command injection exists in the PGP encryption module. This issue occurs because configuration values provided by administrators are concatenated into a shell command without proper sanitization. An attacker with administrator privileges can execute arbitrary operating-system commands as the web server process user by supplying crafted values for the PGP binary path and command options during normal ticket operations.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.