CVE-2026-48208
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
An improper neutralization of active SVG content in OTRS or ((OTRS)) Community Edition ticket article rendering allows attackers to inject specially crafted SVG payloads via email content, leading to browser-side resource exhaustion and denial of service when affected tickets are opened by an agent or customer. The issue can be exploited without JavaScript execution and is not mitigated by the configured Content Security Policy (CSP).
Risk Assessment
An attacker can cause OTRS unavailability for agents and customers by overloading the browser.
Recommendation
Update OTRS to version 2026.4.X or later.
Other vulnerabilities in OTRS
See all- CVE-2026-48188Critical
An improper input validation vulnerability in the database layer module of OTRS and ((OTRS)) Community Edition allows an unauthenticated SQL injection, which can lead to authentication bypass. This issue only affects systems where the MySQL/MariaDB server is configured with the NO_BACKSLASH_ESCAPES SQL mode.
- CVE-2026-48209High
An improper neutralization of user-controllable input in OTRS and ((OTRS)) Community Edition ticket handling allows authenticated attackers to perform reflected XSS attacks via crafted request parameters. Malicious JavaScript can be executed in the context of an authenticated agent session when the crafted link is opened.
- CVE-2026-48191Low
In STORM powered by OTRS and in OTRS (2026.x and above) Document Search Article Meta Filters modules, incorrect permission handling allows gaining knowledge about the number of affected CIs, SLA, and services without gaining access to them.
- CVE-2026-48190Low
In OTRS, the External Interface and ConfigItem List modules incorrectly handle permissions, allowing an authenticated customer to query the system for CI information. This affects only when CMDB is enabled and CustomerGroupSupport is used.
- CVE-2026-48189Medium
An improper input validation vulnerability in the OTRS Customer Backend module allows access to customer information restricted to other groups. This affects versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.4.X, but only when the CustomerGroupSupport feature is enabled.
- CVE-2026-48187Medium
An uncontrolled resource allocation vulnerability in OTRS email handling can lead to excessive resource consumption and webserver abortion. This affects versions 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.4.X, and likely also OTRS Community Edition 6.x and OTRS 7.x.
- CVE-2026-48210Medium
An improper default configuration in OTRS 2026.3.1 causes ticket article forwarding actions to enforce the 'Is visible for customer' flag and prevent users from disabling it via the UI. This leads to unintended exposure of internal ticket information to the External Frontend.
Original NVD description (English source)
An improper neutralization of active SVG content in OTRS or ((OTRS)) Community Edition ticket article rendering allows attackers to inject specially crafted SVG payloads via email content, leading to browser-side resource exhaustion and denial of service when affected tickets are opened by an agent or customer. The issue can be exploited without JavaScript execution and is not mitigated by the configured Content Security Policy (CSP). This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.4.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected