CVE Explorer

CVE-2026-22200

Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filter expressions which are insufficiently sanitized before being processed by the mPDF PDF generator during export. When the attacker exports the ticket to PDF, the generated PDF can embed the contents of attacker-selected files from the serve

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:9e1f50a90a61f7512ca3f804895c91d4bc81c88383fd776e7c9da3a414f9380c

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"defaultStatus":"unaffected","packageURL":"pkg:github/osTicket/osTicket","platforms":["Linux"],"product":"osTicket","repo":"https://github.com/osTicket/osTicket","vendor":"Enhancesoft","versions":[{"lessThan":"1.18.3","status":"affected","version":"1.18.0","versionType":"semver"},{"lessThan":"1.17.7","status":"affected","version":"1.17.0","versionType":"semver"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:da593df3fa648745385f1b6b48a49161a8146c4c00fad03651197c3b486072c1 · sha256:05e86990cbc1cd8a… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.7,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"…

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:da593df3fa648745385f1b6b48a49161a8146c4c00fad03651197c3b486072c1 · sha256:05e86990cbc1cd8a… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion

{"cweId":"CWE-74","description":"CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:da593df3fa648745385f1b6b48a49161a8146c4c00fad03651197c3b486072c1 · sha256:05e86990cbc1cd8a… · /containers/cna/problemTypes/0/descriptions/0

Source references

5 source assertions

{"tags":["patch"],"url":"https://github.com/osTicket/osTicket/commit/c59b067"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:da593df3fa648745385f1b6b48a49161a8146c4c00fad03651197c3b486072c1 · sha256:05e86990cbc1cd8a… · /containers/cna/references/2

{"tags":["release-notes"],"url":"https://github.com/osTicket/osTicket/releases/tag/v1.17.7"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:da593df3fa648745385f1b6b48a49161a8146c4c00fad03651197c3b486072c1 · sha256:05e86990cbc1cd8a… · /containers/cna/references/1

{"tags":["release-notes"],"url":"https://github.com/osTicket/osTicket/releases/tag/v1.18.3"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:da593df3fa648745385f1b6b48a49161a8146c4c00fad03651197c3b486072c1 · sha256:05e86990cbc1cd8a… · /containers/cna/references/0

{"tags":["technical-description","exploit"],"url":"https://horizon3.ai/attack-research/attack-blogs/ticket-to-shell-exploiting-php-filters-and-cnext-in-osticket-cve-2026-22200/"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:da593df3fa648745385f1b6b48a49161a8146c4c00fad03651197c3b486072c1 · sha256:05e86990cbc1cd8a… · /containers/cna/references/3

{"tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/osticket-pdf-export-arbitrary-file-read"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:da593df3fa648745385f1b6b48a49161a8146c4c00fad03651197c3b486072c1 · sha256:05e86990cbc1cd8a… · /containers/cna/references/4

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer