EUVD-2026-52404
GHSA-9f9p-h4h5-j53f
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered via email with no auth required; scope changes to victim browser on ticket view; no availability impact applies.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) via the email From-header display name. The value is extracted without sanitization in include/class.mailparse.php and stored raw in the poster field of ost_thread_entry. When an unauthenticated attacker sends a reply email to an existing ticket from an unregistered address with an XSS payload in the From display name.
AnalysisAI
Stored XSS in osTicket v1.18.3 allows unauthenticated attackers to inject persistent JavaScript into ticket thread views by embedding a malicious payload in the From display name of an inbound email. The unsanitized value is extracted by class.mailparse.php and written raw to the poster field of ost_thread_entry, where it is later rendered without HTML encoding across at least six PHP templates serving both the staff panel and client portal. The upstream commit fix is publicly available, a researcher proof-of-concept disclosure exists, and every staff agent or client who opens the affected ticket executes the payload - multiplying impact from a single malicious email.
Technical ContextAI
osTicket is a PHP-based open-source help desk platform that processes inbound email to create and update support tickets. The vulnerability originates in include/class.mailparse.php, which parses the RFC 5322 From header and extracts the display name portion without sanitization before passing it downstream. In class.thread.php, this value is stored directly as the poster column in ost_thread_entry - confirmed by the commit diff change from 'poster' => $poster to 'poster' => Format::sanitize($poster). The stored raw value is then echoed without encoding in six separate templates: include/client/templates/thread-entry.tmpl.php, include/client/templates/thread-export.tmpl.php, include/staff/templates/thread-entries-preview.tmpl.php, include/staff/templates/thread-entry-view.tmpl.php, and include/staff/templates/thread-entry.tmpl.php - all corrected by adding Format::htmlchars() around the name variable. The root cause is CWE-79, specifically the stored (persistent) XSS subvariant, where attacker-controlled input is persisted to a database and later rendered into an HTML page without output encoding.
RemediationAI
Apply the upstream fix from commit c54a6ac79de42cff35b453882d1d94cd38adb17f (https://github.com/osTicket/osTicket/commit/c54a6ac79de42cff35b453882d1d94cd38adb17f), which introduces Format::sanitize() at storage time in class.thread.php and Format::htmlchars() output encoding across all six affected templates. A tagged patched release version has not been independently confirmed - monitor the osTicket GitHub repository for an official release incorporating this commit before deploying. As a compensating control pending patch deployment, configure osTicket's email ban list to restrict inbound replies to known or whitelisted sender domains, reducing exposure to crafted From headers from arbitrary external senders; note this may block legitimate guest replies and should be evaluated against support workflow requirements. Alternatively, deploy an MTA-level Content-Type or header sanitization rule to strip or truncate non-alphanumeric characters from From display names before delivery to osTicket; this may truncate legitimate international display names and should be tested in a staging environment first. Content Security Policy (CSP) headers restricting inline script execution can limit the impact of any residual XSS vectors but do not eliminate the stored payload.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today