CVE-2026-22200 Scanner

osTicket is a widely used open-source support ticket management system that enables customers to create tickets online via email or web forms, and effectively tracks and manages inquiries. It is used by various organizations and service providers to streamline customer support processes. The software supports ticket assignments, alerts, and collaboration between departments, ensuring efficient case resolution. It is primarily used in environments where customer service is a priority, such as help desks, IT support teams, and service departments.

CVE-2026-22200 is an arbitrary file read vulnerability that arises from insufficient sanitization of user-supplied input within the PDF export functionality of osTicket. When generating a PDF of a ticket, the system improperly handles special characters or path traversal sequences, allowing an attacker to include references to sensitive files on the server. This flaw exists in osTicket versions before 1.18.3 in the 1.18.x series and before 1.17.7 in the 1.17.x series.

The vulnerability specifically targets the ticket PDF export endpoint, where the content of ticket fields (such as subject or message) is processed without adequate validation. An attacker can craft a ticket with malicious input containing path traversal patterns like '../' to read files outside the intended directory. The vulnerable function does not restrict file paths to the expected scope, enabling access to system files like /etc/passwd or application configuration files.

If exploited, an attacker can read arbitrary files on the server, potentially exposing sensitive data such as database credentials, encryption keys, or user information. This could lead to further compromise of the osTicket instance and underlying infrastructure. The CVSS score of 7.5 reflects the high confidentiality impact and the ease of exploitation without authentication in some configurations.