https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 09:36:23 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-63206 <p>Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad&#39;s HTML sanitizer, which blocks remote images in ticket articles and email views, can be bypassed using a shortened URL format that omits the double slash after the scheme (for example a shortened HTTP URL instead of a shortened HTTP URL). Modern browsers treat both forms as equivalent remote URLs. As a result, an attacker who sends a crafted email or ticket can cause the recipient&#39;s browser to silently load an image from an external server, revealing when and by whom the ticket was opened. Zammad&#39;s &#34;remote content blocked&#34; warning is not shown because the sanitizer does not recognize the shortened form as remote. This issue is fixed in version 7.1.2.</p> <p>Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad&#39;s HTML sanitizer, which blocks remote images in ticket articles and email views, can be bypassed using a shortened URL format that omits the double slash after the scheme (for example a shortened HTTP URL instead of a shortened HTTP URL). Modern browsers treat both forms as equivalent remote URLs. As a result, an attacker who sends a crafted email or ticket can cause the recipient&#39;s browser to silently load an image from an external server, revealing when and by whom the ticket was opened. Zammad&#39;s &#34;remote content blocked&#34; warning is not shown because the sanitizer does not recognize the shortened form as remote. This issue is fixed in version 7.1.2.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-63206