Executive brief
osTicket, a popular open-source customer support platform, is affected by a security flaw that allows attackers to inject malicious scripts into support tickets. When a helpdesk agent or administrator views these tickets, the script executes in their browser, potentially allowing the attacker to take over their session, access sensitive customer data, or modify system configurations. This vulnerability stems from an outdated third-party component and insufficient filtering of user-submitted content.
Technical details
osTicket is vulnerable to stored Cross-Site Scripting (XSS) because it includes a known-vulnerable version of Bootstrap Tooltip (3.3.4, affected by CVE-2019-8331). The application's HTML sanitization (htmlLawed) fails to block malicious 'data-template' attributes used by the tooltip component. An unauthenticated remote attacker can submit a ticket containing a crafted HTML payload that triggers JavaScript execution when viewed by an authenticated Agent or Admin. The impact is heightened by the fact that osTicket serves user-uploaded JavaScript files with a 'text/javascript' Content-Type, allowing attackers to bypass inline script limitations by referencing uploaded malicious scripts. The issue is fixed in versions 1.17.8 and 1.18.4.
Affected products
- Enhancesoft osTicket 1.10 to 1.17.7, 1.18.0 to 1.18.3
Timeline
- 2026-06-17: patched: Fixes released in v1.17.8 and v1.18.4
- 2026-07-14: disclosed: CVE-2026-36214 published