Vulnerability · Published Jun 1, 2026 · Assigned by OTRS
CVE-2026-48208Denial-of-Service via SVG Rendering in Ticket
Medium 6.5
In plain English
A medium-severity uncontrolled resource consumption in OTRS from OTRS AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
An improper neutralization of active SVG content in OTRS or ((OTRS)) Community Edition ticket article rendering allows attackers to inject specially crafted SVG payloads via email content, leading to browser-side resource exhaustion and denial of service when affected tickets are opened by an agent or customer. The issue can be exploited without JavaScript execution and is not mitigated by the configured Content Security Policy (CSP). This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.4.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OTRS AG | OTRS | 7.0.x8.0.x2023.x2024.x2025.x2026.x – through 2026.3.x |
| OTRS AG | ((OTRS)) Community Edition | 6.x |
Weakness: CWE-400, CWE-791 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H