This vulnerability arises from improper neutralization of active SVG content in the ticket article rendering component of OTRS and ((OTRS)) Community Edition. Attackers can embed malicious SVG payloads in email content that, when rendered in the ticket interface, cause uncontrolled resource consumption in the browser, resulting in denial of service. The issue affects OTRS versions 7.0.x, 8.0.x, 2023.x, 2024.x, 2025.x, and 2026.x prior to 2026.4.x. The vulnerability does not require JavaScript execution and bypasses Content Security Policy protections. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

Successful exploitation leads to denial of service by exhausting browser resources when an agent or customer opens a ticket containing the malicious SVG payload. There is no confidentiality or integrity impact reported. The attack requires user interaction (opening the ticket) but no privileges or JavaScript execution. This can disrupt normal ticket handling and affect availability of the OTRS service for legitimate users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when opening tickets containing SVG content from untrusted sources. Since Content Security Policy does not mitigate this issue, additional filtering or sanitization of SVG content before rendering may be necessary as a temporary measure.