OTRS Community Edition Authenticated OS Command Injection

OTRS Community Edition is vulnerable to an authenticated OS command injection flaw (CVE-2026-53804) located within its PGP encryption configuration module. The vulnerability occurs because the application fails to adequately sanitize user-supplied input when configuring the PGP binary path and command-line options. An attacker possessing administrator-level privileges within the OTRS platform can leverage this flaw to inject arbitrary shell commands.

The malicious payload is concatenated directly into a system command executed by the underlying web server process. Because the application processes these configuration values during ticket operations, the injected commands run with the privileges of the web server user. This vulnerability represents a significant risk for organizations that allow multiple administrators or have been compromised by a lower-privileged actor looking to escalate control over the web server environment.

Impact

Successful exploitation allows an authenticated administrator to achieve arbitrary command execution on the host server. This impact includes full system compromise of the OTRS application server, potential data exfiltration of sensitive ticket information, and unauthorized access to the underlying OS environment. The vulnerability affects all versions of OTRS Community Edition that incorporate the vulnerable PGP encryption configuration module.

Recommendation

• Identify all administrative accounts with access to the PGP encryption module configuration and restrict access to these settings immediately.
• Audit logs for the OTRS configuration pages to identify recent changes to the PGP binary path or command options settings.
• Prioritize upgrading OTRS Community Edition to a secure version that implements proper input sanitization for configuration fields.
• Review web server process logs for unexpected process execution (e.g., cmd.exe, /bin/sh) originating from the OTRS application service account.