The vulnerability is a path‑traversal flaw in the SendSupportBundle feature that allows an authenticated administrator to reference file paths outside the intended directory. This can lead to the deletion of any files that the OTRS application process is permitted to access. Because it does not bypass operating‑system file permissions, the impact is limited to files with permissive ownership or permissions. No direct disclosure of arbitrary files has been demonstrated.

Affected products include OTRS GmbH (formerly OTRS AG) Community Edition 6.x and earlier, and the commercial OTRS product versions 7.0.x, 8.0.x, 2023.x, 2024.x, 2025.x and 2026.x before 2026.7.x. Products derived from the Community Edition are also likely affected.

The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, so no public exploitation has been reported to date. An attacker needs valid administrative credentials to exploit the flaw. Exploitation requires the SendSupportBundle function to be invoked with a crafted path; once executed, any file that the OTRS user can reach and is not protected by stricter permissions can be deleted. The risk is therefore confined to systems whose operating‑system permissions allow such file deletion and whose configuration permits the SendSupportBundle functionality.