HIGH 8.6 NVD
CVE-2026-53804
OTRS Community Edition contains an authenticated OS command injection vulnerability in the PGP encryption module that allows administrators to execute arbitrary
OTRS Community Edition contains an authenticated OS command injection vulnerability in the PGP encryption module that allows administrators to execute arbitrary operating-system commands by supplying crafted values for the PGP binary path and command options. Administrator-supplied configuration values are concatenated without sanitization into a shell command, enabling arbitrary command execution as the web server process user during normal ticket operations after the malicious configuration is deployed.
References
- https://h00die-gr3y.github.io/research/cve-2026-53804/
- https://www.vulncheck.com/advisories/otrs-community-edition-os-command-injection-via-pgp-c
This high severity vulnerability with a CVSS score of 8.6 was published on 2026-08-20 via NVD.
vulnfeed aggregates 9909 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.