CVE-2026-38444 in osTicket
Summary
by MITRE • 08/03/2026
osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) via the email From-header display name. The value is extracted without sanitization in include/class.mailparse.php and stored raw in the poster field of ost_thread_entry. When an unauthenticated attacker sends a reply email to an existing ticket from an unregistered address with an XSS payload in the From display name.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
The vulnerability in osTicket v1.18.3 represents a critical stored cross-site scripting flaw that originates from improper input sanitization within the email parsing component of the application. This weakness specifically manifests when processing incoming emails through the mail parsing functionality located in include/class.mailparse.php where the From-header display name is extracted without adequate sanitization measures. The unsanitized data is subsequently stored directly in the poster field of the ost_thread_entry database table, creating a persistent XSS vector that affects all users who view the affected ticket thread. The vulnerability exploits the trust placed in email metadata by the system's mail parsing logic, which fails to validate or escape potentially malicious content contained within the display name portion of email headers.
The operational impact of this stored XSS vulnerability extends beyond simple script execution as it provides attackers with the ability to inject malicious JavaScript code that persists across user sessions and ticket views. When an unauthenticated attacker crafts a reply email from an unregistered address with a carefully constructed XSS payload embedded in the From display name, the system processes this input without proper validation, storing the malicious content directly in the database. Any user who subsequently views the affected ticket thread will execute the stored script within their browser context, potentially leading to session hijacking, credential theft, or redirection to malicious sites. The vulnerability affects all users of the system regardless of their authentication status since the malicious payload executes in the context of any user's browser when viewing the compromised ticket thread.
This vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws in web applications, and demonstrates how insecure data handling practices in email parsing components can create persistent security risks within ticketing systems. The attack vector follows ATT&CK technique T1566.001 for credential access through spearphishing attachments or links, while also supporting T1584.002 for infrastructure and tool development through the creation of malicious email content. The exploitation requires minimal privileges as attackers need only send an email to an existing ticket, making this particularly dangerous for public-facing support systems where email submission is unrestricted. The persistent nature of stored XSS means that even if the initial attacker's email is filtered or deleted, the malicious payload remains active within the system until manually removed from the database.
Mitigation strategies should focus on implementing comprehensive input sanitization at the point of data ingestion within the mail parsing component, ensuring all email header values including display names are properly escaped before storage. The system should employ context-aware output encoding when rendering email metadata in user interfaces to prevent script execution regardless of stored content. Additionally, administrators should consider implementing email validation mechanisms that can identify and block suspicious header content patterns, while maintaining regular security audits of email processing components to detect similar vulnerabilities. Database-level protections including field validation constraints can provide additional layers of defense against malicious data entry, though primary prevention must occur at the application logic level where input is first processed and stored.