Threats affecting pkg:github/zammad/zammad

Zammad versions prior to 7.1.2 contain a stored cross-site scripting (XSS) vulnerability in the new Vue-based ticket interface. Authenticated users can inject markup into ticket articles that is rendered without proper output encoding when viewed by others. The default Content Security Policy (CSP) reduces the practical impact of this vulnerability. The classic REST/CoffeeScript interface is not affected. This issue is fixed in version 7.1.2.

A vulnerability in Zammad GmbH's Zammad DEB and RPM packages allows a local attacker with write privileges as the unprivileged zammad service account to escalate to full root privileges. This occurs because service processes temporarily run as root and execute files writable by the zammad account before dropping privileges. The affected services automatically restart without administrator intervention, enabling rapid privilege escalation. Only DEB and RPM package installations are affected; source and official container image installations are not impacted. All released packaged versions from 1.5.0 up to but not including 7.2.2 and 7.1.0-alpha are vulnerable.