Is there a patch available for CVE-2026-48229?

Yes, a patch is available for CVE-2026-48229. Update the affected software to the latest version immediately.

Open ISES Tickets CVE-2026-48229

Q: What is the CVSS score of CVE-2026-48229?

CVE-2026-48229 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31309 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-21 VulnCheck

GHSA-69pg-x7ch-rf7g

PHP XSS

5.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 21, 2026 - 18:38 vuln.today

Analysis Generated

May 21, 2026 - 18:38 vuln.today

CVSS changed

May 21, 2026 - 18:22 NVD

5.4 (MEDIUM) 5.1 (MEDIUM)

DescriptionCVE.org

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in routes_i.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticket_id GET parameter directly into HTML form hidden input value attributes. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim's browser when the response is rendered.

AnalysisAI

Reflected XSS in Open ISES Tickets (all versions before 3.44.2) allows injection of arbitrary JavaScript via the unsanitized ticket_id GET parameter in routes_i.php, rendered directly into HTML form hidden input value attributes. When a victim visits or is redirected to a crafted URL, the payload executes in their browser within the application's security context. No public exploit or CISA KEV listing exists at time of analysis, but the patch release (v3.44.2) simultaneously fixes 88 vulnerabilities - 69 of them XSS - indicating systemic input sanitization failures throughout the codebase that substantially elevate the overall risk posture of this application.

Technical ContextAI

Open ISES Tickets is a PHP-based ticketing system (CPE: cpe:2.3:a:open_ises:tickets:*:*:*:*:*:*:*:*). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Reflected XSS): the application reads the ticket_id value from a GET parameter and writes it into an HTML form hidden input value attribute without encoding or sanitization. This classic output-context failure in PHP templating allows an attacker to break out of the attribute context using a quote character and inject executable script. The v3.44.2 release notes confirm the fix commit (ecfeb406) addressed this alongside 68 other XSS flaws spread across 22 files, pointing to a pattern of raw PHP variable interpolation into HTML rather than isolated miscoding. The affected file, routes_i.php, is part of the routing layer, suggesting the vulnerability is reachable via standard application navigation.

RemediationAI

Upgrade to Open ISES Tickets v3.44.2 immediately, as the vendor has labeled this a Critical Security Update. The patched release is available at https://github.com/openises/tickets/releases/tag/v3.44.2; for Docker deployments, run 'docker compose pull && docker compose up -d'; for traditional installs, extract the zip over the existing installation and run the installer in Upgrade mode. Critically, v3.44.2 also resolves 19 SQL injection vulnerabilities and removes 5 hardcoded secrets - deferring the upgrade carries compound risk beyond this CVE alone. If immediate upgrade is not feasible, deploy a WAF rule to reject or strip script-context metacharacters (single quotes, angle brackets, javascript: URI schemes) from the ticket_id GET parameter in requests to routes_i.php; note this is a compensating control only and will not address the 88 other vulnerabilities fixed in v3.44.2.