CVE-2026-78355: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in OTRS GmbH (former OTRS AG) OTRS

This vulnerability (CWE-22) exists in the SendSupportBundle feature of OTRS, where an authenticated administrator can manipulate file paths to access and delete files outside the intended directory scope. The impact depends on the permissions of the OTRS application process: prior to OTRS 7, the web server's permissions apply; from OTRS 7 onward, a dedicated OTRS user limits access. Although the functionality attempts to include files in a support bundle sent to a fixed OTRS support address, no direct arbitrary file disclosure has been demonstrated. Exploitation requires administrative credentials, limiting the attack surface. The vulnerability affects OTRS versions 6.0.0 through versions before 7.1.0, 8.0.0 through before 8.1.0, and the yearly releases from 2023 through 2026 before 2026.7.X.

An authenticated administrator can delete files accessible to the OTRS application process outside the intended directory, potentially impacting system integrity and availability within the scope of the application's permissions. The vulnerability does not allow bypassing operating system file permissions and does not demonstrate direct arbitrary file disclosure to attackers. The impact is limited to users with valid administrative access.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since exploitation requires valid administrative access, ensure that administrative credentials are tightly controlled and monitored. Review and restrict file system permissions for the OTRS application process to minimize potential damage from this vulnerability.