CVE-2026-22200High· 8.7▾ MidnightPoC availableEnhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 47.8 · likelihood 14.7 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 3 sources. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
74%
1 GitHub repo · Metasploit ×1 · Nuclei ×1 (last check)
Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filter expressions which are insufficiently sanitized before being processed by the mPDF PDF generator during export. When the attacker exports the ticket to PDF, the generated PDF can embed the contents of attacker-selected files from the server filesystem as bitmap images, allowing disclosure of sensitive local files in the context of the osTicket application user. This issue is exploitable in default configurations where guests may create tickets and access ticket status, or where self-registration is enabled.
osTicket >= 1.18.0 < 1.18.3osTicket >= 1.17.0 < 1.17.7Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2022-32074Medium· 5.4A stored cross-site scripting (XSS) vulnerability in the component audit/class.audit.php of osTicket-plugins - Storage-FS before commit a7842d494889fd5533d13deb3c6a7789768795ae allows attackers to execute arbitrary web scripts or HTML vi…
CVE-2020-24881Critical· 9.8SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning.
CVE-2019-14750Medium· 6.1An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1
CVE-2019-14749High· 8.8An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1
CVE-2019-14748Medium· 5.4An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1
CVE-2019-11537Medium· 6.1In osTicket before 1.12, XSS exists via /upload/file.php, /upload/scp/users.php?do=import-users, and /upload/scp/ajax.php/users/import if an agent manager user uploads a crafted .csv file to the User Importer, because file contents can a…