Zammad’s HTML sanitizer mistakenly allows external URLs in the srcset attribute of IMG tags, permitting an attacker to embed tracking pixels that silently load when an agent views a ticket. When loaded, the browser sends the agent’s IP address, User‑Agent, Referer and view timestamp to the attacker, leaking sensitive privacy data. The flaw is a classic improper neutralization of user input (CWE‑82) and is mitigated by the sanitizer’s oversight.

The vulnerability affects Zammad, an open‑source helpdesk/customer support system, specifically versions released before 7.0.2 and before 7.1.0. Any deployment using those legacy versions is susceptible until an update is applied.

The CVSS score of 5.3 indicates moderate severity. Because the flaw requires forging an email or ticket that contains a malicious srcset element, an attacker would need a vector that delivers that content into the agent’s browser. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The likely attack path involves sending a crafted ticket email, which when opened triggers the remote request and privacy leakage.