S4E just found a high top 10 tcp port service scan
high·Product Based Web Vulnerabilities·Updated Jan 28, 2026

CVE-2026-22200 Scanner

Targets the PDF export endpoint in osTicket; an attacker can read arbitrary files on the server by injecting path traversal sequences into ticket content.

Est. Time~10 seconds
Scan TypeSingle Scan
Targetsdomain, subdomain, ipv4
CostFree
2.5k
Times Used
continuous scan runs
3.4k
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
CVECVE-2026-22200
8.7
CVSShigh
Exploitable remotely over the internet · no authentication required.

Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filter expressions which are insufficiently sanitized before being processed by the mPDF PDF generator during export. When the attacker exports the ticket to PDF, the generated PDF can embed the contents of attacker-selected files from the server filesystem as bitmap images, allowing disclosure of sensitive local files in the context of the osTicket application user. This issue is exploitable in default configurations where guests may create tickets and access ticket status, or where self-registration is enabled.

Attack Vector
Network
Privileges Req.
None
User Interaction
None
Affected
osTicketby Enhancesoft
AFFECTED< 1.18.3SAFE ✓≥ 1.18.3
Updated Aug 22, 2026View on NVD →
Detail

osTicket is a widely used open-source support ticket management system that enables customers to create tickets online via email or web forms, and effectively tracks and manages inquiries. It is used by various organizations and service providers to streamline customer support processes. The software supports ticket assignments, alerts, and collaboration between departments, ensuring efficient case resolution. It is primarily used in environments where customer service is a priority, such as help desks, IT support teams, and service departments.

CVE-2026-22200 is an arbitrary file read vulnerability that arises from insufficient sanitization of user-supplied input within the PDF export functionality of osTicket. When generating a PDF of a ticket, the system improperly handles special characters or path traversal sequences, allowing an attacker to include references to sensitive files on the server. This flaw exists in osTicket versions before 1.18.3 in the 1.18.x series and before 1.17.7 in the 1.17.x series.

The vulnerability specifically targets the ticket PDF export endpoint, where the content of ticket fields (such as subject or message) is processed without adequate validation. An attacker can craft a ticket with malicious input containing path traversal patterns like '../' to read files outside the intended directory. The vulnerable function does not restrict file paths to the expected scope, enabling access to system files like /etc/passwd or application configuration files.

If exploited, an attacker can read arbitrary files on the server, potentially exposing sensitive data such as database credentials, encryption keys, or user information. This could lead to further compromise of the osTicket instance and underlying infrastructure. The CVSS score of 7.5 reflects the high confidentiality impact and the ease of exploitation without authentication in some configurations.

Solution Advice
  • Upgrade osTicket to version 1.18.3 or later (1.18.x series) or 1.17.7 or later (1.17.x series) to patch the vulnerability.
  • Disable the PDF export functionality temporarily if an immediate upgrade is not possible to reduce attack surface.
  • Implement strict input validation and sanitization on all ticket fields, especially those used in PDF generation, to block path traversal sequences.
  • Apply a web application firewall (WAF) rule to detect and block requests containing path traversal patterns in ticket content.
  • Restrict file system permissions to limit the impact of file read vulnerabilities by ensuring the web server runs with minimal privileges.
  • Conduct regular security audits and penetration testing to identify similar vulnerabilities in custom or third-party plugins.
  • Monitor server logs for unusual file access patterns or attempts to read sensitive files through the PDF export endpoint.

Get AI-powered remediation steps tailored to your asset.

Try AI Solutions →

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.

osTicket Arbitrary File Read Scanner | S4E Free Check S4E