SECURITY ADVISORY

OTOBO 10.0.26 – Security Patch

PUBLISHING DATE:
RELEASE TYPE:
CRITICALITY:
AFFECTED VERSION:

September 25, 2025
Security Patch Release
MEDIUM
OTOBO 10.0

Security Fix

[Security | high] Fix for potential privilege escalation via backup.pl
We have closed a potential security vulnerability which – only on systems configured to allow backup.pl to be executed with root permissions by any user (e.g. through modifications in the sudoers file) – enabled command injection. This could allow standard users on the OTOBO server to execute arbitrary commands with root privileges.
Standard installations are not affected.
Thanks to Diego Berger Tellaroli for reporting this issue! [#4619]

Changes

[Change] Docker: Upgraded Perl base image to 5.38-bookworm [#4619]

Bugfixes

[Bugfix] System Configuration: Fixed an issue where saving a setting as a favorite did not work. [#4130]
[Bugfix] AgentTicketActionCommon: Fixed an issue where the type update did not respect current parameters when saving. [#4359]

Next steps

Update to OTOBO 10.0.26

We recommend that you fix the vulnerability and benefit from the latest improvements. Please update your system.

➞ Download Security Patch

OTOBO 10.0 Change Log

A comprehensive overview of all present and past changes.

➞ See all changes

🔔 Reminder: End of Support for OTOBO 10.0

We’d like to remind you that support for OTOBO 10.0 will end at the end of this year.

To ensure you continue working securely and efficiently, we recommend upgrading to the latest version. Our team will be happy to support you – from planning to implementation.

As always, feel free to reach out with any questions.

Contact

OTOBO 10.0.26 – Security Patch

Security Fix

Changes

Bugfixes

Next steps

Update to OTOBO 10.0.26

OTOBO 10.0 Change Log

Company

Software

Services

Community