CVE-2024-33668

9.1 criticalEPSS 0.4%

Critical (9.1) in zammad zammad. EPSS 0.4% chance of exploitation in the next 30 days.

An issue was discovered in Zammad before 6.3.0. The Zammad Upload Cache uses insecure, partially guessable FormIDs to identify content. An attacker could try to brute force them to upload malicious content to article drafts they have no access to.

Severity

CVSS 3.1

9.1 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-31)
CWE: CWE-639
Published: 2024-04-26
Modified: 2026-09-16
Record from: the NVD, synced 2026-10-19

Affected

zammad:zammad

References

https://a7.de/fue/advisories/cve-2024-33668/
https://zammad.com/en/advisories/zaa-2024-02
https://zammad.com/en/advisories/zaa-2024-02

Check your stack JSON