Vulnerability · Published Aug 20, 2026 · Assigned by VulnCheck

CVE-2026-53804OTRS Community Edition OS Command Injection via PGP Configuration

High 7.2

In plain English

A high-severity OS command injection in OTRS Community Edition from Centuran Consulting. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)1.5%top 25.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

OTRS Community Edition contains an authenticated OS command injection vulnerability in the PGP encryption module that allows administrators to execute arbitrary operating-system commands by supplying crafted values for the PGP binary path and command options. Administrator-supplied configuration values are concatenated without sanitization into a shell command, enabling arbitrary command execution as the web server process user during normal ticket operations after the malicious configuration is deployed.

Affected products (as reported)

Vendor	Product	Versions
Centuran Consulting	OTRS Community Edition	0 – through 6.0.41

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

Researcher Disclosure technical-description, exploit
https://www.vulncheck.com/advisories/otrs-community-edition-os-command-injection-via-pgp-configuration third-party-advisory