Exploitation Summary
EIP tracks 1 public exploit for CVE-2026-34724. PoCs published by 0xBlackash.
AI-analyzed exploit summary The repository contains a Python script that checks the version of Zammad to determine if it is vulnerable to CVE-2026-34724, an SSTI vulnerability in the AI Agent feature. It does not include exploit code but provides a safe version check.
Description
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a server-side template injection vulnerability which leads to RCE via AI Agent exists. Impact is limited to environments where an attacker can control or influence type_enrichment_data (typically high-privilege administrative configuration). This vulnerability is fixed in 7.0.1.
Exploits (1)
The repository contains a Python script that checks the version of Zammad to determine if it is vulnerable to CVE-2026-34724, an SSTI vulnerability in the AI Agent feature. It does not include exploit code but provides a safe version check.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H