OTRS: Path traversal in SendSupportBundle allows file deletion
Summary
A path traversal flaw in the SendSupportBundle functionality of OTRS allows an authenticated administrator to reference file paths outside the intended directory. An attacker can thereby delete files that the OTRS application process is permitted to modify, and the CVSS base score is 8.7 (High). Exploitation requires valid administrative access; direct disclosure of arbitrary files has not been demonstrated.
Affected
- OTRS 7.0.x
- OTRS 8.0.x
- OTRS 2023.x, 2024.x, 2025.x
- OTRS 2026.x before 2026.7.1
- ((OTRS)) Community Edition 6.x and earlier (per the advisory text; exact CE version list unverified)
- Products based on ((OTRS)) Community Edition are likely affected
Fixed in
- OTRS 2026.7.1 or later
- OTRS 7: no patch planned by the vendor; upgrade to a supported branch
- Community Edition fix: unknown
Workaround
- No vendor workaround known.
- Restrict administrator accounts to the necessary minimum and enforce MFA on admin logins.
- Limit the file system permissions of the dedicated OTRS service user to what it needs.
Exploitation
- Not listed in the CISA KEV catalog; no known active exploitation.
- No confirmed public proof of concept found.
- CISA SSVC: exploitation none, automatable no, technical impact partial.
- EPSS score is low (about 0.007).
Our recommendation
- Inventory all OTRS instances and their exact versions, including Community Edition installations.
- Upgrade 2026.x systems to OTRS 2026.7.1 or later.
- Plan a migration for OTRS 7.0.x and other unsupported branches, as no patch is planned.
- Restrict admin accounts, enforce MFA, and check the file permissions of the OTRS service user.
- Monitor admin activity and file deletions in the OTRS installation.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- OTRS Security Advisory 2026-12 otrs.com
- CVE record (CVE List V5) raw.githubusercontent.com
- VulDB CVE-2026-78355 vuldb.com
- OSV Ubuntu CVE-2026-78355 osv.dev
- OpenCVE CVE-2026-78355 app.opencve.io
- TheHackerWire CVE-2026-78355 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:01.
Original description (NVD)
A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory. This may allow files accessible to the OTRS application process to be deleted. The vulnerability does not bypass operating system file permissions. On OTRS versions prior to OTRS 7, the effective permissions of the web server process are relevant. Starting with OTRS 7, access is limited by the permissions of the dedicated OTRS user. Files with overly permissive ownership or file system permissions may therefore also be affected. The affected functionality may additionally attempt to include controlled files in a support bundle. However, support bundles are sent to a predefined OTRS support address, and direct disclosure of arbitrary files to the attacker has not been demonstrated. An attacker therefore requires valid administrative access to exploit the vulnerable functionality. The primary demonstrated impact is the deletion of files outside the intended directory within the effective permissions of the OTRS application process. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.