Zammad, a web‑based help‑desk platform, contains a vulnerability that allows an authenticated agent to inject path‑traversal sequences into image URLs within inbound email or ticket content. The image sanitizer, which is supposed to restrict URLs to a safe allowlist, incorrectly accepts internal traversal paths and forwards the request to a protected API endpoint. Because the browser uses the agent’s session cookie, the target API can trigger side effects such as a forced logout. The flaw is a classic example of path traversal (CWE‑22) that leads to unintended authentication changes and potential service disruption.

The issue affects installations of the Zammad application version 7.1.1 or earlier. Any instance running Zammad on a web server that allows agents to view inbound emails or tickets is potentially vulnerable until the fix is applied in release 7.1.2.

The CVSS score of 5.3 reflects moderate severity; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Because the flaw requires authenticated agent access and relies on browser resolution of URLs, exploitation is limited to agents with sufficient privileges viewing affected content. An attacker could deliberately trigger forced logouts, creating a denial‑of‑service for agents or forcing users to re‑authenticate. While it does not lead to remote code execution, repeated abuse could degrade service availability and affect user experience.