Zammad में AI एजेंट के माध्यम से RCE की ओर ले जाने वाला सर्वर-साइड टेम्पलेट इंजेक्शन है

The impact of CVE-2026-34724 is significant due to its potential for Remote Code Execution. Successful exploitation would allow an attacker to gain control over the Zammad server, potentially leading to data breaches, system compromise, and disruption of helpdesk operations. The vulnerability is limited to environments where an attacker can control or influence the typeenrichmentdata, typically requiring administrative privileges. This means an attacker needs to have some level of access or influence over the Zammad configuration to exploit the vulnerability. A successful attack could allow an attacker to read sensitive customer data, modify support tickets, or even install malware on the server.

Organizations using Zammad as their helpdesk/customer support system, particularly those with administrative users who may inadvertently introduce malicious data into the typeenrichmentdata configuration, are at risk. Shared hosting environments where multiple Zammad instances share resources could also be vulnerable if one instance is compromised.

• zammad: Examine Zammad logs for unusual activity or errors related to the AI Agent feature, specifically looking for attempts to manipulate typeenrichmentdata. • generic web: Use curl to probe the Zammad instance for potential template injection points.

curl -X POST 'https://zammad.example.com/api/v1/ai_agent/enrichment' -d '{"type_enrichment_data": "<script>alert(\"XSS\")</script>"}'

• generic web: Check access and error logs for suspicious requests or error messages related to template processing.

1. 2026-04-08Disclosure

   disclosure

1. आरक्षित2026-03-30
2. प्रकाशित2026-04-08
3. संशोधित2026-04-09
4. EPSS अद्यतन2026-04-16

The primary mitigation for CVE-2026-34724 is to immediately upgrade Zammad to version 7.0.1 or later. If upgrading is not immediately feasible, restrict access to the typeenrichmentdata configuration to trusted users only. Carefully review and validate any data being passed to the AI Agent feature. Consider implementing a Web Application Firewall (WAF) with rules to detect and block suspicious template injection attempts. Monitor Zammad logs for unusual activity or errors related to the AI Agent feature. After upgrading, confirm the fix by attempting to trigger the vulnerable template injection scenario and verifying that it is no longer exploitable.