Read the docs
TI-2019-10960 Aliases CVE-2019-14748GHSA-v3wf-9r8f-h42x

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1.

Priority LOW 30CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Code execution, Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-434 and CWE-79.

Summary

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. The Ticket creation form allows users to upload files along with queries. It was found that the file-upload functionality has fewer (or no) mitigations implemented for file content checks; also, the output is not handled properly, causing persistent XSS that leads to cookie stealing or malicious actions. For example, a non-agent user can upload a .html file, and Content-Disposition will be set to inline instead of attachment.

Why it matters now

EPSS 0.02733 86th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD and the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:enhancesoft:osticket:*:*:*:*:*:*:*:*before 1.10.7; 1.12 to before 1.12.1VulnerableEnhancesoft
  • cpe:2.3:a:enhancesoft:osticket:*:*:*:*:*:*:*:* Versions before 1.10.7; 1.12 to before 1.12.1 Vulnerable ·Enhancesoft

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-14748
  2. 2026-10-03 Alias added: GHSA-v3wf-9r8f-h42x

References

Exploit 2

Patch 1

Advisory 2

  • TI-2026-17810 osTicket (1.18.x < 1.18.3, 1.17.x < 1.17.7) PDF Export Arbitrary File Read CVSS 4.0HIGH 8.7
  • TI-2020-15225 SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning. CVSS 3.1CRITICAL 9.8
  • TI-2022-13727 Session Fixation vulnerability in in function login in class.auth.php in osTicket through 1.16.2. CVSS 3.1HIGH 8.8
  • TI-2025-19272 A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in… CVSS 3.1MEDIUM 6.5
  • TI-2023-14123 A denial of service attack might be launched against the server if an unusually lengthy… CVSS 3.1HIGH 7.5
  • TI-2022-03911 Cross-site Scripting (XSS) - Reflected in osticket/osticket CVSS 3.1MEDIUM 5.4
See all 44 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences