Zammad 6.5.1

Incorrect Access Control in Knowledge Base

A permission issue was identified where agents could see titles of Knowledge Base articles they didn’t have permission to access when using the global search. While the article content remained protected, these entries should not have been visible at all. This has now been corrected.

📖 For more details, please refer to the Security Advisory ZAA-2025-05.

HTML Injection

Various sections of the Zammad front end failed to perform the correct HTML escape function when outputting data. This could have allowed HTML injection in the browser. However, execution of JavaScript code was correctly prevented by Content Security Policy.

📖 For more details, please refer to the Security Advisory ZAA-2025-06.

Technical Requirements

Please note that you must meet the following browser requirements to use this version:

• Chrome: 83
• Firefox: 78
• Explorer: 11
• Safari: 11
• Opera: 69
• Edge: 83

Advisories

ZAA-2025-05
ZAA-2025-06

Download Zammad 6.5.1

All improvements can be found in the Changelog.

Packages

• Ubuntu / Debian
• OpenSUSE / SLES
• CentOS / RHEL
• Docker-Compose

Source code

• ftp.zammad.com/zammad-6.5.1.tar.bz2
  (fe9b2e645f8ecb8bb1b090d8aa61a846)
• ftp.zammad.com/zammad-6.5.1.tar.gz
  (9e2789a9f54f06166332cf78d4011b64)
• ftp.zammad.com/zammad-6.5.1.zip
  (33da8a7755fff7e6787b88cf109d489a)

Upgrade

Here you can find information on upgrading your Zammad installation:

• With Package
• From source
• With Docker