ZSA-2026-15

Date: 2026-09-16
Affected: All versions of Znuny LTS from 6.5.1 up to including 6.5.24.
All versions of Znuny from 7.3.1 up to including 7.3.6.
All versions of Znuny 6.0, 6.1, 6.2, 6.3, 6.4, 7.0, 7.1, and 7.2.
Severity: medium
CVE: Requested

A SQL injection vulnerability exists in the ticket search (Kernel::System::Ticket::TicketSearch and Kernel::System::Ticket::ArticleSearchIndex::DB) via the ContentSearch parameter. The parameter is expected to be either "AND" or "OR", but its value was concatenated directly into the generated SQL query without validation.

Fixed in: Znuny LTS 6.5.25 and Znuny 7.3.7

Thanks for reporting to Mokrane ABDELMALEK (via the Ghent University VDP programme).