CVE-2026-48212
Stored XSS in external pages
CVSS Score
4.8
EPSS Score
0.0%
EPSS Percentile
0th
An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X
| CWE | CWE-79 |
| Vendor | otrs gmbh (former otrs ag) |
| Product | otrs |
| Published | Oct 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for otrs gmbh (former otrs ag) otrs
Be the first to know when new medium vulnerabilities affecting otrs gmbh (former otrs ag) otrs are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
OTRS GmbH (former OTRS AG) / OTRS
7.0.x 8.0.x 2023.x 2024.x 2025.x 2026.x ≤ 2026.6.x
References
Credits
🔍 Special thanks to William Bastos (@chor4o) and Samara Gama (igobysamy) for reporting this vulnerability