ZSA-2026-04

Date: 2026-03-25
Affected: All versions of Znuny LTS from 6.5.1 up to including 6.5.18.
All versions of Znuny from 7.2.1 up to including 7.2.3.
All versions of Znuny 6.0, 6.1, 6.2, 6.3, 6.4, 7.0, and 7.1.
Severity: low
CVE: Not requested

By using the source code mode of the HTML editor, HTML elements could be injected into ticket article fields. The injected payload can e.g. be successfully rendered as a clickable link in both the customer and agent views.

Fixed in: Znuny LTS 6.5.19 and Znuny 7.3.1