CVE-2024-33668
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
An issue was discovered in Zammad before 6.3.0. The Zammad Upload Cache uses insecure, partially guessable FormIDs to identify content. An attacker could try to brute force them to upload malicious content to article drafts they have no access to.
Risk Assessment
Risk of unauthorized upload of malicious content to article drafts, potentially leading to data integrity issues and possible malware distribution.
Recommendation
Update Zammad to version 6.3.0 or later that fixes this vulnerability. Restrict access to the Upload Cache and monitor file upload activity.
Other vulnerabilities in Zammad
See all- CVE-2017-6081High
A CSRF issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. An attacker can exploit this vulnerability by sending cross-domain requests directly to the REST API for users with a valid session cookie.
- CVE-2017-6080Critical
An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, caused by lack of a protection mechanism involving HTTP Access-Control headers. An attacker can send cross-domain requests directly to the REST API for users with a valid session cookie and receive the result.
- CVE-2017-5619Critical
An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1 that allows attackers to login using the hashed password instead of the valid password string.
- CVE-2026-13229High
Zammad 7.1.0 contains an authenticated improper authorization vulnerability in the ticket article attachment cloning endpoint.
- CVE-2026-34837Medium
Zammad prior to version 7.0.1 contains an authorization failure in the REST endpoint POST /api/v1/ai_assistance/text_tools/:id. Context data (e.g., a group or organization) supplied for use in the AI prompt were not checked for accessibility by the current user, leading to unauthorized data being used in the prompt.
- CVE-2026-34782Medium
In Zammad, a web-based open source helpdesk system, prior to versions 7.0.1 and 6.5.4, the REST endpoint POST /api/v1/ai_assistance/text_tools/:id did not check if a user is privileged to use the text tool, allowing its use in all situations without proper authorization.
- CVE-2026-34724High
Zammad before version 7.0.1 has a server-side template injection (SSTI) vulnerability leading to remote code execution (RCE) via the AI Agent. Impact is limited to environments where an attacker can control type_enrichment_data (typically high-privilege administrative configuration).
- CVE-2026-34723High
Zammad before versions 7.0.1 and 6.5.4 allows unauthenticated attackers to access the 'getting started' endpoint, which exposes sensitive internal entity data even after system setup is complete.
- CVE-2026-34722Medium
In Zammad, a web-based open source helpdesk system, prior to versions 7.0.1 and 6.5.4, the endpoint used for ticket creation was missing authorization when the parameter for adding links was used, allowing unauthorized ticket creation with links.
- CVE-2026-34721Medium
CSRF vulnerability in Zammad prior to 7.0.1 and 6.5.4. OAuth callback endpoints for Microsoft, Google, and Facebook do not validate a CSRF state parameter.
Original NVD description (English source)
An issue was discovered in Zammad before 6.3.0. The Zammad Upload Cache uses insecure, partially guessable FormIDs to identify content. An attacker could try to brute force them to upload malicious content to article drafts they have no access to.