CVE-2026-78355 OTRS GmbH (former OTRS AG) CVE debrief

Who should care

OTRS administrators and security teams responsible for OTRS installations should assess exposure and prioritize remediation. They should verify file system permissions, review administrative access controls, and ensure that OTRS installations are updated or mitigated according to vendor guidance.

Why it matters

CVE-2026-78355 is a path traversal vulnerability in OTRS' SendSupportBundle functionality that allows an authenticated administrator to delete files outside the intended directory. OTRS administrators and security teams should assess exposure, verify file system permissions, and prioritize remediation to prevent potential data loss or corruption.

• File deletion within effective permissions of OTRS application process
• Potential data loss or corruption due to file deletion
• Need to verify file system permissions and administrative access controls
• Remediation priority for OTRS installations

Technical summary

The vulnerability is caused by a path traversal issue in OTRS' SendSupportBundle functionality, allowing an authenticated administrator to reference file paths outside the intended directory. This may result in file deletion within the effective permissions of the OTRS application process. The affected functionality may additionally attempt to include controlled files in a support bundle. However, support bundles are sent to a predefined OTRS support address, and direct disclosure of arbitrary files to the attacker has not been demonstrated. An attacker therefore requires valid administrative access to exploit the vulnerable functionality. The primary demonstrated impact is the deletion of files outside the ...

Defensive priority

OTRS administrators should verify and limit administrative access, review file system permissions, and assess exposure for OTRS installations.

Recommended defensive actions

• Verify and limit administrative access to OTRS installations
• Review file system permissions for OTRS application process
• Assess exposure for OTRS installations and prioritize remediation
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information on the vulnerability. OTRS GmbH (former OTRS AG) is the affected vendor. The vulnerability allows file deletion within the effective permissions of the OTRS application process.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.