Description
The file upload feature in OTRS and ((OTRS)) Community Edition has a path traversal vulnerability. This issue permits authenticated agents or customer users to upload potentially harmful files to directories accessible by the web server, potentially leading to the execution of local code like Perl scripts.
This issue affects OTRS: from 7.0.X through 7.0.49, 8.0.X, 2023.X, from 2024.X through 2024.3.2; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OTRS | OTRS | 7.0.x – ≤ 7.0.49, 8.0.x, 2023.x, 2024.x – ≤ 2024.3.2 | — |
| OTRS | ((OTRS)) Community Edition | 6.0.1 – ≤ 6.0.34 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | znuny | No fix yet | — |
| Ubuntu 26.04 LTS | znuny | No fix yet | — |
| Ubuntu 25.10 | znuny | No fix yet | — |
| Ubuntu 24.04 LTS | znuny | No fix yet | — |
Advisories 1
- WID-SEC-2024-1267 OTRS: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Jun 2, 2024