CVE-2026-48212: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in OTRS GmbH (former OTRS AG) OTRS

This vulnerability (CVE-2026-48212) in OTRS arises from improper neutralization of input during web page generation (CWE-79). Specifically, an OTRS administrator can insert arbitrary JavaScript code into the content of a custom page. This code is stored by the application and executed in the context of users' browsers when they view the custom page, enabling potential cross-site scripting attacks. The affected versions include OTRS 7.0.x, 8.0.x, and the 2023.x through 2026.x series prior to version 2026.7.x.

Successful exploitation allows an OTRS administrator to execute arbitrary JavaScript in the browsers of users viewing the custom page. This can lead to information disclosure or manipulation of user sessions within the affected application context. The CVSS vector indicates network attack vector, low attack complexity, high privileges required (administrator), and user interaction required, with partial confidentiality and integrity impact but no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch links are provided, users should monitor OTRS vendor communications for updates. Until a fix is available, restrict administrator privileges to trusted personnel and avoid creating or accessing custom pages with untrusted content.