# CVE-2026-22200: Enhancesoft osTicket arbitrary file read in PDF export

Source: https://junglewise.ai/threats/cve-2026-22200-enhancesoft-osticket-arbitrary-file-read-in-pdf-export  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-12. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-22200 · Severity: high · CVSS 7.5 · Published 2026-01-12

osTicket is a popular open-source helpdesk system used by organizations to manage customer support requests. A security flaw in the ticket export feature allows unauthorized individuals to view sensitive files stored on the server, such as configuration files or system credentials. By submitting a specially crafted ticket and then downloading it as a PDF, an attacker can trick the system into embedding private server data directly into the document.

Technologies: [Enhancesoft osTicket](https://junglewise.ai/threats/technologies/osticket). Vendors: [Enhancesoft](https://junglewise.ai/threats/vendors/enhancesoft).

## Quick answers

**Is CVE-2026-22200 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-22200 being exploited in the wild.

**How severe is CVE-2026-22200?** High severity, with a CVSS score of 7.5, published 12 January 2026.

**Which products and versions are affected?** Enhancesoft osTicket 1.17.x prior to 1.17.7, 1.18.x prior to 1.18.3.

**Is there a fix for CVE-2026-22200?** A patch was published on 2026-01-15: Official patches released in versions 1.17.7 and 1.18.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-22200 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-22200?** Check whether you run Enhancesoft osTicket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An arbitrary file read vulnerability exists in osTicket's ticket PDF export functionality. The root cause is the improper neutralization of PHP filter expressions within rich-text HTML submitted in tickets. When a ticket containing these crafted expressions is processed by the mPDF generator during export, the application fails to sanitize the input, allowing the attacker to embed the contents of local files as bitmap images within the resulting PDF. This vulnerability is reachable by unauthenticated guests in default configurations where ticket creation and status access are enabled. When chained with other flaws like CVE-2024-2961 (CNEXT), this can lead to remote code execution. The issue is resolved in versions 1.17.7 and 1.18.3.

## Affected products

- Enhancesoft osTicket 1.17.x prior to 1.17.7, 1.18.x prior to 1.18.3

## Timeline

- 2026-01-12: advisory: Initial CVE publication date
- 2026-01-15: patched: Official patches released in versions 1.17.7 and 1.18.3
- 2026-01-22: disclosed: Detailed technical write-up and exploit analysis published by Horizon3.ai

## References

- [https://github.com/osTicket/osTicket/commit/c59b067](https://github.com/osTicket/osTicket/commit/c59b067)
- [https://github.com/osTicket/osTicket/releases/tag/v1.17.7](https://github.com/osTicket/osTicket/releases/tag/v1.17.7)
- [https://github.com/osTicket/osTicket/releases/tag/v1.18.3](https://github.com/osTicket/osTicket/releases/tag/v1.18.3)
- [https://horizon3.ai/attack-research/attack-blogs/ticket-to-shell-exploiting-php-filters-and-cnext-in-osticket-cve-2026-22200/](https://horizon3.ai/attack-research/attack-blogs/ticket-to-shell-exploiting-php-filters-and-cnext-in-osticket-cve-2026-22200/)
- [https://www.vulncheck.com/advisories/osticket-pdf-export-arbitrary-file-read](https://www.vulncheck.com/advisories/osticket-pdf-export-arbitrary-file-read)

## Related threats

- [osTicket logic vulnerability in password reset token validation](https://junglewise.ai/threats/cve-2026-18363-osticket-logic-vulnerability-in-password-reset-token-validation)
- [osTicket stored XSS in Bootstrap Tooltip component](https://junglewise.ai/threats/cve-2026-36214-osticket-stored-xss-in-bootstrap-tooltip-component)
- [Enhancesoft osTicket session fixation in OSTSESSID](https://junglewise.ai/threats/cve-2026-9507-enhancesoft-osticket-session-fixation-in-ostsessid)
- [osTicket user enumeration via timing side-channel in pwreset.php](https://junglewise.ai/threats/cve-2026-26895-osticket-user-enumeration-via-timing-side-channel-in-pwreset-php)