Active SVG Injection DoS in OTRS Ticket Article Rendering

The repository is a minimal proof-of-concept for CVE-2026-48208 and contains only two files: a short README and a single Python script, `mail_send.py`. The Python script is the sole functional component and serves as the exploit entry point. It uses Python's standard `smtplib` and `email.mime` libraries to authenticate to an SMTP server over STARTTLS on port 587 and send an HTML-formatted email to a specified target mailbox identified as an OTRS address. The exploit capability is delivery of a crafted HTML email payload rather than direct network exploitation of the target application. The embedded payload combines malformed HTML (`<img src="x<"onmouseover="console.log(123)">`) with a large, recursively expanded SVG structure using repeated `<defs>`, `<g>`, and `<use xlink:href=...>` references. This strongly suggests the PoC is intended to exercise weaknesses in HTML/SVG sanitization or rendering in an OTRS web interface or associated browser context. The JavaScript is only a benign demonstration (`console.log(123)`), so the repository does not include a post-exploitation shell or command-execution payload. Structurally, the script defines SMTP configuration placeholders, sender/recipient placeholders, a hardcoded HTML body, a `send_email()` helper that constructs and transmits the message, and a `main()` function that invokes it. There is no target discovery, no vulnerability verification logic, no framework integration, and no payload customization beyond editing constants in the script. As a result, this is best characterized as a simple operational PoC email-delivery exploit for a client-side/webmail rendering issue affecting OTRS.