Enhancesoft osTicket up to 1.18.2 Ticket PDF Export injection

Summaryinfo

A vulnerability has been found in Enhancesoft osTicket up to 1.18.2 and classified as problematic. This vulnerability affects unknown code of the component Ticket PDF Export. Performing a manipulation results in injection. This vulnerability is reported as CVE-2026-22200. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability classified as problematic has been found in Enhancesoft osTicket up to 1.18.2. This affects an unknown part of the component Ticket PDF Export. The manipulation with an unknown input leads to a injection vulnerability. CWE is classifying the issue as CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. This is going to have an impact on confidentiality. The summary by CVE is:

Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filter expressions which are insufficiently sanitized before being processed by the mPDF PDF generator during export. When the attacker exports the ticket to PDF, the generated PDF can embed the contents of attacker-selected files from the server filesystem as bitmap images, allowing disclosure of sensitive local files in the context of the osTicket application user. This issue is exploitable in default configurations where guests may create tickets and access ticket status, or where self-registration is enabled.

The weakness was disclosed by Naveen Sunkavally. This vulnerability is uniquely identified as CVE-2026-22200 since 01/06/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/28/2026). MITRE ATT&CK project uses the attack technique T1055 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-1918). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Ticket Tracking Software

Vendor

• Enhancesoft

Name

• osTicket

Version

• 1.18.0
• 1.18.1
• 1.18.2

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion