Description

An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.8",
  "pubDate": "2026-10-12T07:16:36.610Z",
  "pubdate": "2026-10-12T07:16:36.610Z",
  "executiveSummary": "This vulnerability is a Stored Cross-Site Scripting (XSS) flaw identified in OTRS Custom Pages. The issue arises from the application failing to properly sanitize user-supplied input when creating or editing custom page content.\nSuccessful exploitation allows an authenticated OTRS administrator to inject arbitrary JavaScript payloads into the application's database. When a victim, such as another administrator or a user, accesses the affected custom page, the malicious script executes within the context of the user's session.\nThe impact includes potential session hijacking, unauthorized actions performed on behalf of the victim, theft of sensitive information, or redirection to malicious sites.\nAffected products include OTRS versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X prior to 2026.7.X.\nExploitation requires administrative privileges within the OTRS environment. Given the high privilege level required to initiate the attack, the risk is significant, as it permits lateral movement or escalation if targeting other privileged accounts.",
  "technicalDetails": "The root cause of this vulnerability is improper neutralization of input during the creation or modification of Custom Pages within the OTRS platform. The application accepts content input from administrative users and stores this data directly in the application database without sufficient sanitization or output encoding mechanisms.\nThis vulnerability is classified as Stored Cross-Site Scripting (XSS). An authenticated user with administrative privileges possesses the capability to inject malicious JavaScript payloads directly into the content field of a Custom Page.\nThe attack flow proceeds as follows: First, the attacker, possessing legitimate administrative credentials, accesses the Custom Page management interface. Second, the attacker crafts a malicious JavaScript payload designed to perform unauthorized actions, such as capturing session cookies, hijacking the user's document object model (DOM), or performing unauthorized API requests. Third, the attacker saves this malicious script as the content of a Custom Page. Fourth, when a legitimate user, such as a staff member or another administrator, navigates to this specific Custom Page, the OTRS application renders the stored content in the victim's browser without adequate encoding. Consequently, the browser interprets the injected JavaScript as legitimate code associated with the trusted domain, resulting in execution within the victim's security context.\nBecause the payload is persistent in the database, the script will execute every time a user views the compromised page. The scope of the execution is limited by the victim's browser's security policies, but generally includes full access to the Document Object Model (DOM), the ability to make arbitrary HTTP requests via the browser's XMLHttpRequest or Fetch API (subject to Same-Origin Policy, though often bypassed if the malicious script is running on the same domain as the application), and the ability to read sensitive session identifiers (if not protected by HttpOnly flags).\nThis vulnerability affects OTRS versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.7.X. It is inherently dangerous because it allows for persistent, client-side code execution initiated by a trusted account, which can then be used to compromise accounts with higher or equivalent privileges."
}