---
id: CVE-2026-48212
title: >-
  An OTRS administrator can enter arbitrary JavaScript into the content of an
  OTRS Custom Page, which is stored by the application and subsequently executed
  in the browser of users accessing that page.


  This issue affects OTRS:

    *  7.0.X…
summary: >-
  An OTRS administrator can enter arbitrary JavaScript into the content of an
  OTRS Custom Page, which is stored by the application and subsequently executed
  in the browser of users accessing that page.


  This issue affects OTRS:

    *  7.0.X…
severity: medium
cvss: 4.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T07:16:36.610'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48212'
references:
  - url: 'https://otrs.com/release-notes/otrs-security-advisory-2026-11/'
    label: security@otrs.com
tags:
  - nvd
ingestedAt: '2026-10-12T14:50:34.094Z'
---

## Overview

An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page.

This issue affects OTRS:

  *  7.0.X
  *  8.0.X
  *  2023.X
  *  2024.X
  *  2025.X
  *  2026.X before 2026.7.X

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.