OTRS vulnerabilities
We track 13 vulnerabilities in OTRS products across 2 products. 13 are rated high or critical, and none are known to be exploited. The most recent was published on June 1, 2026.
Latest OTRS vulnerabilities
- 7.1 High severity
OTRS: Improper Neutralization of Input During Web Page Generation
An improper neutralization of user-controllable input in OTRS or ((OTRS)) Community Edition ticket handling allows authenticated attackers to perform reflected cross-site scripting (XSS) attacks via crafted request parameters associated with ticket actions. By
- 9.1 Critical severity
An improper Input Validation vulnerability in OTRS or ((OTRS)) Community Edition database…
An improper Input Validation vulnerability in OTRS or ((OTRS)) Community Edition database layer module allows an unauthenticated SQL injection which can lead to an authentication bypass. This issue only affects the system if the MySQL/MariaDB server is configu
- 8.2 High severity
OTRS: Insertion of Sensitive Information into Log File
Passwords of agents and customers are displayed in plain text in the OTRS admin log module if certain configurations regarding the authentication sources match and debugging for the authentication backend has been enabled. This issue affects: * OTRS from 7.0.X
- 7.5 High severity
OTRS: Incorrect Privilege Assignment
An incorrect privilege assignment vulnerability in the inline editing functionality of OTRS can lead to privilege escalation. This flaw allows an agent with read-only permissions to gain full access to a ticket. This issue arises in very rare instances when an
- 7.5 High severity
OTRS: Insertion of Sensitive Information into Log File
Insertion of debug information into log file during building the elastic search index allows reading of sensitive information from articles.This issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023.X through 2023.1.1.
- 9.8 Critical severity
OTRS: Improper Validation of Integrity Check Value
Improper Input Validation vulnerability in the upload functionality for user avatars allows functionality misuse due to missing check of filetypes. This issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023 through 2023.1.1.
- 7.5 High severity
OTRS: Insufficiently Protected Credentials
A Vulnerability in OTRS AgentInterface and ExternalInterface allows the reading of plain text passwords which are send back to the client in the server response- This issue affects OTRS: from 8.0.X through 8.0.37.
- 9.1 Critical severity
OTRS: Improper Certificate Validation
The functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static SSL or TLS based communication. As the SSL_get_verify_result() function is not used the certificated is trusted always and it can not be ensured that the c
- 8.8 High severity
OTRS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface modules allows any authenticated attacker to to perform an host header injection for the ContentType h
- 7.2 High severity
OTRS: Improper Neutralization of Special Elements used in an OS Command
Improper Neutralization of commands allowed to be executed via OTRS System Configuration e.g. SchedulerCronTaskModule using UnitTests modules allows any authenticated attacker with admin privileges local execution of Code.This issue affects OTRS: from 7.0.X be
- 8.1 High severity
OTRS: Incorrect Authorization
Improper Authorization vulnerability in OTRS AG OTRS 8 (Websocket API backend) allows any as Agent authenticated attacker to track user behaviour and to gain live insight into overall system usage. User IDs can easily be correlated with real names e. g. via ti
- 7.8 High severity
OTRS: Improper Control of Generation of Code
Improper Input Validation vulnerability in OTRS AG OTRS (ACL modules), OTRS AG ((OTRS)) Community Edition (ACL modules) allows Local Execution of Code. When creating/importing an ACL it was possible to inject code that gets executed via manipulated comments an
- 9.8 Critical severity
OTRS: Improper Neutralization of Special Elements used in an SQL Command
Improper Input Validation vulnerability in OTRS AG OTRS, OTRS AG ((OTRS)) Community Edition allows SQL Injection via TicketSearch Webservice This issue affects OTRS: from 7.0.1 before 7.0.40 Patch 1, from 8.0.1 before 8.0.28 Patch 1; ((OTRS)) Community Edition