What is CVE-2026-48208?

CVE-2026-48208 is a medium-severity vulnerability in Otrs, classified under Uncontrolled Resource Consumption. CVSS score: 6.5/10. Published 2026-06-01.

How severe is CVE-2026-48208?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Is CVE-2026-48208 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Resource exhaustion in Otrs

CVE-2026-48208

An improper neutralization of active SVG content in OTRS or ((OTRS)) Community Edition ticket article rendering allows attackers to inject specially crafted SVG payloads via email content, leading to browser-side resource exhaustion and denial of service when affected tickets are opened by an agent or customer. The issue can be exploited without JavaScript execution and is not mitigated by the configured Content Security Policy (CSP). This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.4.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected

Vulnerability class: DoS (Denial of Service)

EPSS: 0.003 (26.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.

Affected products

Otrs
Otrs Ag — versions 7.0.x, 8.0.x, 2023.x
Otrs Ag ((Otrs)) Community Edition — versions 6.x

Weakness classification (CWE)

Public proof-of-concept exploits

Habuon/CVE-2026-48208

References

security@otrs.com (Vendor Advisory)

Frequently asked questions

What is CVE-2026-48208?: CVE-2026-48208 is a medium-severity vulnerability in Otrs, classified under Uncontrolled Resource Consumption. CVSS score: 6.5/10. Published 2026-06-01.
How severe is CVE-2026-48208?: Medium severity. CVSS v3 base score is 6.5 out of 10.
Is CVE-2026-48208 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.