The vulnerability arises from insufficient validation of session identifiers used in Zammad's long‑polling and WebSocket connections. When the client provides a crafted identifier, the server uses it to build a file path without sanitizing it. An authenticated user can then traverse directories and delete files or directories located outside the intended session storage directory. This path traversal leads directly to the deletion of arbitrary files, which may include critical configuration or data files, thereby compromising server integrity and availability.

Zammad versions 7.0.2 and 7.1.0 are affected when the default file‑based session store is in use. Instances that are configured to use a Redis session store are not impacted. The issue is fixed in Zammad 7.0.3 and 7.1.1, which provide proper validation of session identifiers before path construction.

The CVSS score of 8.8 indicates high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only a low‑privilege authenticated session and a single crafted request, typically sent over the long‑polling or WebSocket channel. Attackers can derive arbitrary paths relative to the session store, causing deletion of files that may affect the application, the data store, or the operating system if sufficient permissions exist. The attack vector is likely an authenticated network access to the Zammad server, with the attacker controlling the session token.