CVE-2026-48212
4.8MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
An authenticated administrator can execute arbitrary JavaScript in the browsers of users who visit custom pages. They need administrative access to OTRS to create or edit the malicious Custom Page and a user to view it.
Root cause
OTRS fails to sanitize or encode user-supplied JavaScript inside Custom Page content before rendering it to visitors.
Affected systems
OTRS 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.7.X
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Fix & remediation
Upgrade OTRS to version 2026.7.X or later. If patching immediately is not possible, restrict administrative access to Custom Pages or audit and disable untrusted Custom Pages.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X