Path Traversal in OTRS SendSupportBundle File Deletion

A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory. This may allow files accessible to the OTRS application process to be deleted. The vulnerability does not bypass operating system file permissions. On OTRS versions prior to OTRS 7, the effective permissions of the web server process are relevant. Starting with OTRS 7, access is limited by the permissions of the dedicated OTRS user. Files with overly permissive ownership or file system permissions may therefore also be affected. The affected functionality may additionally attempt to include controlled files in a support bundle. However, support bundles are sent to a predefined OTRS support address, and direct disclosure of arbitrary files to the attacker has not been demonstrated. An attacker therefore requires valid administrative access to exploit the vulnerable functionality. The primary demonstrated impact is the

Casky was already ahead

This CVE exploits attack patterns that Casky's 351matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-78355 is a path traversal vulnerability (CWE-22) in OTRS's SendSupportBundle functionality that permits authenticated administrators to reference and delete files outside their intended directory scope. While the vulnerability requires valid administrative credentials and respects underlying operating system file permissions, it represents a significant risk because it enables privileged users to delete critical application files or system configurations they shouldn't normally access. Organizations running OTRS versions prior to 7 face elevated risk due to web server process permissions, while OTRS 7+ mitigates exposure through dedicated user context. This vulnerability matters because it can lead to denial of service, application instability, or exposure of sensitive information if attackers gain administrator access through other means and leverage this path traversal to manipulate the system.

Casky's 351 matching security skills leverage Claude's extended reasoning to map this vulnerability against MITRE ATT&CK techniques TA0001 (Initial Access) and TA0007 (Discovery). Practitioners using Casky would see detection patterns identifying reconnaissance activities where attackers probe OTRS instances for SendSupportBundle endpoints, followed by post-exploitation techniques where authenticated sessions attempt directory traversal sequences (../ patterns, symbolic link resolution, or absolute path references). The platform's Claude-powered analysis would correlate suspicious file deletion patterns with administrator account activity, flag anomalous API calls to SendSupportBundle that reference out-of-scope paths, and identify lateral movement indicators if an attacker uses deleted system files to disable monitoring or audit logging. Security teams would receive findings showing the attack chain from credential compromise through file system manipulation, enabling them to detect both exploitation attempts and post-compromise cleanup activities.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

351 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-78355.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2026-78355

Casky has 351 skills that investigate the attack patterns behind CVE-2026-78355. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn