Zammad versions before 7.0.1 and 6.5.4 fail to properly neutralize script‑related HTML tags in ticket articles, allowing storage of malicious content in the database. When rendered in the GUI, the content is displayed without sufficient filtering, creating a stored cross‑site scripting risk. Although the current CSP rules limit the harm of clicking links, an attacker could potentially inject scripts that run in the context of any user who views the affected ticket, leading to data theft or session hijacking.

The affected product is Zammad, the web‑based helpdesk system released by the zammad project. Only installations running versions older than 7.0.1 or 6.5.4 are vulnerable; newer releases contain the fix.

With a CVSS score of 5.3 the vulnerability is considered moderate severity. No EPSS score is available, and it is not listed in CISA’s KEV catalog, indicating limited evidence of active exploitation. Based on the description, the likely attack vector is through the web interface: an attacker can submit malicious ticket content which is then stored and later rendered for other users. The exploitation requires the ability to create or edit ticket articles, so it is limited to users with that privilege, but within that scope the impact is significant.