osTicket
CVE-2026-22200
HIGH
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, low-complexity, unauthenticated in default guest configs (AV:N/AC:L/PR:N/UI:N); confidentiality-only file disclosure with no integrity or availability impact and no scope change.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
9DescriptionCVE.org
Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filter expressions which are insufficiently sanitized before being processed by the mPDF PDF generator during export. When the attacker exports the ticket to PDF, the generated PDF can embed the contents of attacker-selected files from the server filesystem as bitmap images, allowing disclosure of sensitive local files in the context of the osTicket application user. This issue is exploitable in default configurations where guests may create tickets and access ticket status, or where self-registration is enabled.
AnalysisAI
Arbitrary local file read in Enhancesoft osTicket 1.18.x (before 1.18.3) and 1.17.x (before 1.17.7) lets a remote unauthenticated attacker embed the contents of server-side files into an exported ticket PDF. By submitting a ticket whose rich-text HTML carries crafted PHP filter expressions, the attacker abuses the mPDF export path to render attacker-chosen files as bitmap images, disclosing sensitive data such as configuration files and credentials. Publicly available exploit code exists (Horizon3 'Ticket to Shell' research) and the EPSS score of 13.58% (94th percentile) reflects elevated near-term exploitation likelihood; there is no public exploit identified as active in CISA KEV.
Technical ContextAI
osTicket is a PHP-based open-source support ticketing platform. The flaw is a CWE-74 injection: user-supplied rich-text HTML in a ticket body is insufficiently sanitized before being handed to the mPDF library during PDF generation (include/class.pdf.php). Attackers smuggle PHP stream-wrapper filter chains (php://filter/...) - the same primitive behind the referenced 'CNext' research - through image/CSS url() and src attributes, causing mPDF to read local filesystem paths and encode them into the output PDF as images. The vendor fix strips CSS url() usages, denies srcset, tightens the cid: image regex to require a proper prefix, and explicitly unregisters/restores the php stream wrapper around PDF rendering (@stream_wrapper_unregister('php')), directly neutralizing the filter-chain vector. Affected CPE: cpe:2.3:a:enhancesoft:osticket:*.
RemediationAI
Vendor-released patch: upgrade to osTicket 1.18.3 (for 1.18.x) or 1.17.7 (for 1.17.x), which contain fix commit c59b067 (https://github.com/osTicket/osTicket/commit/c59b067). If immediate patching is not possible, reduce exposure by disabling guest self-registration and restricting anonymous ticket creation/status access so unauthenticated users cannot submit crafted HTML (trade-off: blocks legitimate anonymous submissions and self-service portals); additionally restrict or disable the ticket-to-PDF export feature, or place the helpdesk behind authentication/VPN, since the file-read only triggers on PDF export (trade-off: removes a convenience feature staff rely on). At the platform level, ensure PHP is hardened so php:// filter wrappers cannot reference sensitive paths, but treat this only as defense-in-depth - the authoritative fix is the upgrade. Reference the vendor advisories linked above.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today