Zammad (< 7.0.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/zammad--7.0.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 30 Oct 2026 18:01:03 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgZammad: Server-Side Template Injection remote code execution (CVE-2026-34724)https://feed.craftedsignal.io/briefs/2026-10-zammad-ssti/Fri, 30 Oct 2026 18:01:03 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-zammad-ssti/An authenticated administrator can exploit a Server-Side Template Injection (SSTI) vulnerability in the Zammad AI Agent feature to achieve remote code execution via the type_enrichment_data configuration.CVE-2026-34724 is a Server-Side Template Injection (SSTI) vulnerability identified in the Zammad helpdesk software's AI Agent feature. The vulnerability allows an authenticated administrator to inject arbitrary templates into the 'type_enrichment_data' configuration, which are subsequently rendered, leading to full Remote Code Execution (RCE) on the server. The vulnerability is confirmed in Zammad version 7.0.0 and is remediated in version 7.0.1.

Impact

Successful exploitation allows an authenticated attacker with administrative privileges to execute arbitrary commands on the underlying server as the process user (typically 'zammad' or 'www-data').

Recommendation

  • Upgrade Zammad installations to version 7.0.1 or 6.5.4 immediately.
  • If patching is not feasible, disable the AI Agent feature in the Zammad configuration.
  • Review administrative access controls and restrict access to the 'type_enrichment_data' configuration to highly trusted personnel only.
  • Monitor Zammad system logs for unauthorized changes to administrative configuration parameters, specifically 'type_enrichment_data'.
]]>highadvisoryvulnerabilityrcesstiwebserver