Executive brief
osTicket is a popular open-source helpdesk system used by organizations to manage customer support requests. A security flaw in the ticket export feature allows unauthorized individuals to view sensitive files stored on the server, such as configuration files or system credentials. By submitting a specially crafted ticket and then downloading it as a PDF, an attacker can trick the system into embedding private server data directly into the document.
Technical details
An arbitrary file read vulnerability exists in osTicket's ticket PDF export functionality. The root cause is the improper neutralization of PHP filter expressions within rich-text HTML submitted in tickets. When a ticket containing these crafted expressions is processed by the mPDF generator during export, the application fails to sanitize the input, allowing the attacker to embed the contents of local files as bitmap images within the resulting PDF. This vulnerability is reachable by unauthenticated guests in default configurations where ticket creation and status access are enabled. When chained with other flaws like CVE-2024-2961 (CNEXT), this can lead to remote code execution. The issue is resolved in versions 1.17.7 and 1.18.3.
Affected products
- Enhancesoft osTicket 1.17.x prior to 1.17.7, 1.18.x prior to 1.18.3
Timeline
- 2026-01-12: advisory: Initial CVE publication date
- 2026-01-15: patched: Official patches released in versions 1.17.7 and 1.18.3
- 2026-01-22: disclosed: Detailed technical write-up and exploit analysis published by Horizon3.ai
References
- https://github.com/osTicket/osTicket/commit/c59b067
- https://github.com/osTicket/osTicket/releases/tag/v1.17.7
- https://github.com/osTicket/osTicket/releases/tag/v1.18.3
- https://horizon3.ai/attack-research/attack-blogs/ticket-to-shell-exploiting-php-filters-and-cnext-in-osticket-cve-2026-22200/
- https://www.vulncheck.com/advisories/osticket-pdf-export-arbitrary-file-read