How severe is CVE-2026-22200?

CVE-2026-22200 has a CVSS 4.0 base score of 8.7 (HIGH). EPSS estimates a 73.6% probability of exploitation in the next 30 days.

CVE-2026-22200: osTicket (1.18.x < 1.18.3, 1.17.x

Q: What is CVE-2026-22200?

Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filter expressions which are insufficiently sanitized before being processed by the mPDF PDF generator during export. When the attacker exports the ticket to PDF, the generated PDF can embed the contents of attacker-selected files from the server filesystem as bitmap images, allowing disclosure of sensitive local files in the context of the os

Description

Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filter expressions which are insufficiently sanitized before being processed by the mPDF PDF generator during export. When the attacker exports the ticket to PDF, the generated PDF can embed the contents of attacker-selected files from the server filesystem as bitmap images, allowing disclosure of sensitive local files in the context of the osTicket application user. This issue is exploitable in default configurations where guests may create tickets and access ticket status, or where self-registration is enabled.

Severity

CVSS 4.0 · CNA8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC · CISA-ADP

Exploitationnone

Automatableyes

Technical impactpartial

Exploitation Context

as of October 14, 2026

All KEV statistics→

Its current EPSS score (73.6%) is higher than that of 60% of CISA KEV entries.

Affected Products

Vendor	Product	Affected versions
Enhancesoft	Enhancesoft osTicket	1.18.0 to <1.18.3 1.17.0 to <1.17.7

References

5 Links

Patches

https://github.com/osTicket/osTicket/commit/c59b067

Exploits & PoCs

https://horizon3.ai/attack-research/attack-blogs/ticket-to-shell-exploiting-php-filters-and-cnext-in-osticket-cve-2026-22200/

Third-party advisories

https://www.vulncheck.com/advisories/osticket-pdf-export-arbitrary-file-read

Release notes

Record Details

Published

2026-01-12

Last updated

2026-07-14

Assigner (CNA)

VulnCheck

Credited to

Naveen Sunkavally, Horizon3.ai

Tool categories

Application Security Tools Penetration Testing Tools

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.

CVE-2026-22200