Description

OTRS Community Edition contains an authenticated OS command injection vulnerability in the PGP encryption module that allows administrators to execute arbitrary operating-system commands by supplying crafted values for the PGP binary path and command options. Administrator-supplied configuration values are concatenated without sanitization into a shell command, enabling arbitrary command execution as the web server process user during normal ticket operations after the malicious configuration is deployed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-20T21:17:06.813Z",
  "pubdate": "2026-08-20T21:17:06.813Z",
  "executiveSummary": "OTRS Community Edition suffers from an authenticated OS command injection vulnerability residing within its PGP encryption module. This security flaw enables authenticated administrators to achieve arbitrary operating-system command execution by supplying specifically crafted values for the PGP binary path and command options configuration settings. The root cause stems from the insecure concatenation of administrator-supplied input directly into shell commands without prior validation or sanitization. Successful exploitation results in arbitrary code execution running under the security context of the web server process user during routine ticket operations. The risk implication is severe, as an attacker with administrative privileges can fully compromise the underlying host system, escalate access, exfiltrate sensitive data, or disrupt operational availability. Exploitation requires authenticated administrative access to the OTRS management console and the ability to modify the PGP module configuration settings.",
  "technicalDetails": "The vulnerability is an OS command injection flaw located in the PGP encryption module of OTRS Community Edition. The vulnerable component fails to properly sanitize administrative inputs, specifically the configuration parameters designated for the PGP binary path and associated command options. When the application executes cryptographic operations or ticket handling routines that invoke PGP encryption or decryption, these unsanitized configuration values are directly concatenated into a system shell command string and passed to the underlying operating system interpreter.\nThe attack flow proceeds as follows: First, an authenticated attacker with administrative privileges navigates to the PGP configuration interface within the OTRS administration panel. Second, the attacker supplies a malicious payload containing command chaining operators or shell metacharacters within the PGP binary path or command options fields. Third, the attacker saves the malicious configuration state. Fourth, during subsequent normal ticket operations that trigger the PGP module, OTRS executes the constructed shell command. Finally, the operating system evaluates the injected metacharacters, resulting in the execution of arbitrary operating-system commands in the context of the web server process user.\nThe authentication requirement is authenticated administrative access, and the privilege requirement is administrative rights within the OTRS application. The network exposure corresponds to the standard web interface of the OTRS deployment. Post-exploitation impact includes full system compromise, unauthorized access to internal network resources, database manipulation, data theft, and persistence establishment on the host server."
}