A path traversal vulnerability in Zammad versions 7.0.2 and 7.1.0 allows authenticated attackers to delete arbitrary files, posing a high risk to system integrity and availability.

The application fails to properly validate session identifiers used in websocket and long-polling connections, enabling a path traversal (CWE-22) attack. This allows a low-privilege authenticated user to manipulate file paths and delete critical system files when the default file-based session store is active.

The ability for an attacker to delete arbitrary files on the server can lead to total system compromise, service disruption, and potential loss of sensitive helpdesk data. Given the CVSS score of 8.8, this vulnerability is categorized as High severity, as it facilitates unauthorized destructive actions that can result in significant downtime and operational instability.

Immediate Action: Update Zammad to version 7.0.3 or 7.1.1 immediately to resolve the session management flaw.

Proactive Monitoring: Monitor server access logs for suspicious requests containing path traversal patterns or unexpected file deletion activity in the session storage directory.

Compensating Controls: If an immediate update is not feasible, migrate the Zammad session storage configuration from the default file-based store to a Redis-based store, which is not susceptible to this specific attack vector.

Public Exploit Available: No (exploit_available: false)

Organizations running Zammad 7.0.2 or 7.1.0 must prioritize patching to versions 7.0.3 or 7.1.1 to mitigate the risk of arbitrary file deletion. If patching cannot be performed immediately, switching to a Redis-based session store is an effective and necessary security measure to prevent exploitation of this path traversal vulnerability.