Znuny LTS 6.5.25

Znuny LTS 6.5.25#

Release Information:

Release Date

16-SEP-2026

Release Type

Patchlevel with security fixes

Download

https://download.znuny.org/releases/znuny-6.5.25.tar.gz

GitHub

znuny/Znuny

Changes & Improvements#

  • Kernel::SystemAddress::SystemAddressLookup is now case-insensitive when comparing system addresses.

Security Fixes#

  • CVE-2026-48188: Fixed a possible SQL injection vulnerability in the agent login.

  • Fixed an SQL injection vulnerability via the ContentSearch parameter of the ticket search. Thanks for reporting to Mokrane ABDELMALEK (via the Ghent University VDP programme).

  • Fixed an unauthenticated login vulnerability via the generic interface when combined with HTTP basic auth and a request header containing the username (REMOTE_USER in the HTTP header). Thanks for reporting to Mokrane ABDELMALEK (via the Ghent University VDP programme).

  • Updated the JavaScript library nunjucks from version 3.2.3 to 3.2.4.

Bug Fixes#

  • Fixed a warning thrown by the ticket event storing customer company data in dynamic fields when the ticket had no customer ID set.

  • Fixed ticket search “Newer/Older” Date and Minutes filters no longer matching tickets that fall exactly on the given time. Thanks to @martinpintar-pixel for reporting. (#840)

  • Fixed content type and attachment keys leaking into transition action modules (e.g. DynamicFieldSet) that treat every config key as a dynamic field name, causing the transition action to fail.

  • Fixed agent/customer redirection after accepting the initial information dialog (AgentInfo/CustomerAccept).

  • Fixed some ticket attributes not being properly inserted into OTRS_TICKET_* placeholders.

Read about all changes in the CHANGES.md. See the commits on GitHub for a list of all changes.