CVE-2026-48208 — Denial of Service

title: CVE-2026-48208 - OTRS SVG Denial of Service via Email
id: scw-2026-06-01-ai-1
status: experimental
level: medium
description: |
  Detects specially crafted SVG payloads within email content, indicative of CVE-2026-48208. The vulnerability allows for resource exhaustion and denial of service when OTRS ticket articles containing these SVG elements are rendered. This rule specifically looks for SVG tags and common JavaScript event handlers often used in such exploits, which are designed to trigger without explicit user interaction beyond opening the ticket.
author: SCW Feed Engine (AI-generated)
date: 2026-06-01
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-48208/
tags:
  - attack.initial_access
  - attack.t1566.002
logsource:
    category: email
detection:
  selection:
      field|contains:
          - '<svg'
          - 'onload='
          - 'onerror='
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse