Vulnerability in Enhancesoft Osticket
CVE-2026-22200
Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filter expressions which are insufficiently sanitized before being processed by the mPDF PDF generator during export. When the attacker exports the ticket to PDF, the generated PDF can embed the contents of attacker-selected files from the server filesystem as bitmap images, allowing disclosure of sensitive local files in the context of the osTicket application user. This issue is exploitable in default configurations where guests may create tickets and access ticket status, or where self-registration is enabled.
EPSS: 0.736 (99.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Enhancesoft Osticket — versions 1.18.0, 1.17.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- disclosure@vulncheck.com (release-notes, Release Notes)
- disclosure@vulncheck.com (release-notes, Release Notes)
- disclosure@vulncheck.com (Patch, patch)
- disclosure@vulncheck.com (Exploit, technical-description, exploit)
- disclosure@vulncheck.com (Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2026-22200?
- CVE-2026-22200 is a high-severity vulnerability in Enhancesoft Osticket, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 7.5/10. Published 2026-01-12.
- How severe is CVE-2026-22200?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2026-22200 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.