---
id: CVE-2026-48212
title: >-
  An OTRS administrator can enter arbitrary JavaScript into the content of an
  OTRS Custom Page, which is stored by the application and subsequently executed
  in the browser of users accessing that page.


  This issue affects OTRS:

    *  7.0.X…
summary: >-
  An OTRS administrator can enter arbitrary JavaScript into the content of an
  OTRS Custom Page, which is stored by the application and subsequently executed
  in the browser of users accessing that page.


  This issue affects OTRS:

    *  7.0.X…
severity: medium
cvss: 4.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: OTRS GmbH (former OTRS AG)
product: OTRS
affected:
  - OTRS 7.0.x
  - OTRS 8.0.x
  - OTRS 2023.x
  - OTRS 2024.x
  - OTRS 2025.x
  - OTRS >= 2026.x <= 2026.6.x
published: '2026-10-12'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T20:38:44.050'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48212'
references:
  - url: 'https://otrs.com/release-notes/otrs-security-advisory-2026-11/'
    label: security@otrs.com
tags:
  - nvd
  - cve.org
epss: 0.00143
epssPercentile: 0.0354
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-15T17:51:34.895193Z'
ingestedAt: '2026-10-12T14:50:34.094Z'
---

## Overview

An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page.

This issue affects OTRS:

  *  7.0.X
  *  8.0.X
  *  2023.X
  *  2024.X
  *  2025.X
  *  2026.X before 2026.7.X

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.