TI-2026-17810 Aliases CVE-2026-22200 GHSA-4hcq-q3qf-q453

osTicket (1.18.x < 1.18.3, 1.17.x < 1.17.7) PDF Export Arbitrary File Read

HIGH 82CWE-74Published 2026-01-12 · Updated 2026-11-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filter expressions which are insufficiently sanitized before being processed by the mPDF PDF generator during export. When the attacker exports the ticket to PDF, the generated PDF can embed the contents of attacker-selected files from the server filesystem as bitmap images, allowing disclosure of sensitive local files in the context of the osTicket application user. This issue is exploitable in default configurations where guests may create tickets and access ticket status, or where self-registration is enabled.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.73589 99th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA and NVD

Fix Fixed osTicket (Enhancesoft): 1.18.3, 1.17.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Enhancesoft	osTicket	1.18.0 to before 1.18.3; 1.17.0 to before 1.17.7	1.18.3, 1.17.7	Patch available	CNA

osTicket VendorEnhancesoft Affected 1.18.0 to before 1.18.3; 1.17.0 to before 1.17.7 Fixed in 1.18.3, 1.17.7 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:enhancesoft:osticket::::::::	1.17 to before 1.17.7; 1.18 to before 1.18.3	Vulnerable	Enhancesoft

cpe:2.3:a:enhancesoft:osticket:*:*:*:*:*:*:*:* Versions 1.17 to before 1.17.7; 1.18 to before 1.18.3 Vulnerable ·Enhancesoft

Remediation

Fix · CNA osTicket (Enhancesoft) Fixed in 1.18.3, 1.17.7

Timeline

2026-10-02 Threatist record created from CVE-2026-22200
2026-10-03 Alias added: GHSA-4hcq-q3qf-q453

References

Exploit 1

https://horizon3.ai/attack-research/attack-blogs/ticket-to-shell-exploiting-php-filters-and-cnext-in-osticket-cve-2026-22200/

Patch 1

https://github.com/osTicket/osTicket/commit/c59b067

Other 2

TI-2020-15225 SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning. CVSS 3.1CRITICAL 9.8
TI-2022-13727 Session Fixation vulnerability in in function login in class.auth.php in osTicket through 1.16.2. CVSS 3.1HIGH 8.8
TI-2025-19272 A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in… CVSS 3.1MEDIUM 6.5
TI-2023-14123 A denial of service attack might be launched against the server if an unusually lengthy… CVSS 3.1HIGH 7.5
TI-2022-03911 Cross-site Scripting (XSS) - Reflected in osticket/osticket CVSS 3.1MEDIUM 5.4
TI-2026-21411 User enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote… CVSS 3.1MEDIUM 5.3

See all 44 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences