CVE-2026-34724: high-severity vulnerability in zammad
Zammad has a server-side template injection leading to RCE via AI Agent
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.3%
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a server-side template injection vulnerability which leads to RCE via AI Agent exists. Impact is limited to environments where an attacker can control or influence type_enrichment_data (typically high-privilege administrative configuration). This vulnerability is fixed in 7.0.1.
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
zammad · zammadRelated CVEs — zammad
In the same product, most dangerous first.
CVE-2026-63006MEDIUMZammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcsetEPSS 0.5%CVE-2026-34723HIGHZammad has incorrect access control in getting_started_controllerEPSS 0.5%CVE-2026-56735MEDIUMZammad: Improper neutralization of `srcset` attribute in IMG tags in ZammadEPSS 0.4%CVE-2026-56725HIGHZammad: Denial of Service via OTRS Import ControllerEPSS 0.4%CVE-2026-56734MEDIUMZammad: Avatar Image URL Server-Side Request ForwardingEPSS 0.4%CVE-2026-56729LOWZammad: Titles of knowledge base answers will be shown across all categories via the global searchEPSS 0.4%