Vulnerability in Enhancesoft Osticket
CVE-2026-22200
Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML th…
EPSS: 0.744 (98.9th percentile) — read the EPSS interpretation.
Affected products
- Enhancesoft Osticket — versions 1.18.0, 1.17.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/osTicket/osTicket/releases/tag/v1.18.3 (release-notes)
- github.com/osTicket/osTicket/releases/tag/v1.17.7 (release-notes)
- github.com/osTicket/osTicket/commit/c59b067 (patch)
- horizon3.ai/attack-research/attack-blogs/ticket-to-shell-exploiting-php-filters… (technical-description, exploit)
- www.vulncheck.com/advisories/osticket-pdf-export-arbitrary-file-read (third-party-advisory)
Frequently asked questions
- What is CVE-2026-22200?
- CVE-2026-22200 is a vulnerability in Enhancesoft Osticket, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). Published 2026-01-12.
- Is CVE-2026-22200 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.