CVE-2026-63006

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browser resolves the URL to a protected...

CVE-2026-63006

Prior to version 7.1.2 , the Zammad helpdesk system is vulnerable to a security bypass where attacker-controlled HTML in inbound emails or tickets can circumvent the image URL sanitizer . By using path traversal sequences , an attacker can cause the browser to resolve a URL to a protected API end...

EUVD-2026-87270

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browser resolves the URL to a protected...

CVE-2026-63006: Improper Limitation of a Pathname to a Restricted Directory

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browser resolves the URL to a protected...

PT-2026-99078

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description An issue exists where attacker-controlled HTML in inbound emails or tickets can bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browse...

GHSA-MXM6-V9R6-R94C @nuxtjs/mdc's URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration

Summary @nuxtjs/mdc renders untrusted markdown including raw HTML to a Vue component tree. Across two prior advisories it added a URL/attribute sanitizer to block dangerous links in that HTML: validateProps / validateProp and an unsafeLinkPrefix deny-list dist/runtime/parser/utils/props.js. The...

CVE-2026-63671 @nuxtjs/mdc: the URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration

MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to 0.22.1, @nuxtjs/mdc uses parseMarkdown with allowDangerousHtml enabled by default and relies on validateProps, validateProp, and unsafeLinkPrefix to remove executable URLs from untrusted...

CVE-2026-48760

Symfony HtmlSanitizer/UrlSanitizer::parse() had an underinclusive denial for BiDi formatting characters and Unicode whitespace, allowing percent-encoded BiDi marks to bypass the check. The issue affects UrlSanitizer::parse() behavior from Symfony 6.1.0 up to 6.4.41, 7.4.13, and 8.0.13, where raw ...

CVE-2026-48760 Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlSanitizer::parse rejected raw BiDi formatting characters but not percent-encoded forms and used an ASCII-only whitespace check, allowing sanitized URLs...

CVE-2026-45064

CVE-2026-45064 (Symfony) affects the UrlSanitizer::parse() path used by Symfony HtmlSanitizer/UrlSanitizer. From versions 6.1.0-BETA1 up to 6.4.40, 7.4.12, and 8.0.12, Unicode explicit-direction BiDi formatting characters were passed through into sanitized href/src attributes, enabling phishing-s...

PT-2026-44133

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 5.4.31 Description The parse function in SymfonyComponentHtmlSanitizerTextSanitizerUrlSanitizer utilized by UrlSanitizer::sanitize and any HtmlSanitizer configuration permitting links or media fails to filter Unicode...