PT-2026-2291 · Osticket+1 · Osticket+1

Naveen Sunkavally

·

Published

2026-01-12

·

Updated

2026-03-01

·

CVE-2026-22200

CVSS v4.0

8.7

High

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Enhancesoft osTicket versions 1.17.x prior to 1.17.7 and 1.18.x prior to 1.18.3
Description osTicket contains an arbitrary file read issue in the ticket PDF export functionality. A remote attacker can submit a ticket with crafted rich-text HTML containing PHP filter expressions that are not properly sanitized before processing by the mPDF PDF generator. Exporting the ticket to PDF allows embedding the contents of attacker-selected files from the server filesystem as bitmap images, potentially disclosing sensitive local files within the osTicket application user's context. This is exploitable in default configurations where guests can create tickets and access ticket status, or when self-registration is enabled. The issue can lead to the disclosure of sensitive configuration data, including database credentials and secret keys.
Recommendations Update osTicket to version 1.17.7 or later. Update osTicket to version 1.18.3 or later.

Exploit

Fix

RCE

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2026-22200

Affected Products

Mpdf
Osticket