((OTRS)) Community Edition vulnerabilities

2 known vulnerabilities in ((OTRS)) Community Edition from OTRS GmbH (former OTRS AG). 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.4 Critical severity

  OTRS: Authentication Bypass by Spoofing

  CVE-2026-93582Oct 12, 2026OTRS GmbH (former OTRS AG)

  The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated username from either the REMOTE_USER or HTTP_REMOTE_USER environment variable. In CGI and mod_perl based deployments, HTTP request headers may be mapped to

• 8.7 High severity

  OTRS: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-78355Oct 12, 2026OTRS GmbH (former OTRS AG)

  A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory. This may allow files accessible to the OTRS application process to be deleted. The vulnerab