This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: Arbitrary File Read via PDF Export. ๐ฅ **Consequences**: Attackers can leak sensitive local server files by injecting crafted HTML into tickets.โฆ
๐ก๏ธ **CWE**: CWE-74 (Improper Neutralization of Special Elements). ๐ **Flaw**: Insufficient sanitization of rich-text HTML containing PHP filter expressions before processing by the mPDF PDF generator.
Q3Who is affected? (Versions/Components)
๐ฆ **Vendor**: Enhancesoft (osTicket). ๐ **Affected**: Versions **1.18.x prior to 1.18.3** AND **1.17.x prior to 1.17.7**. ๐ **Published**: 2026-01-12.
Q4What can hackers do? (Privileges/Data)
๐ต๏ธ **Action**: Remote attackers submit tickets with malicious HTML. ๐ **Data**: Disclose sensitive files from the server filesystem (e.g., config files, source code) embedded in the generated PDF as bitmaps.
Q5Is exploitation threshold high? (Auth/Config)
โ ๏ธ **Threshold**: **Low**. Exploitable in default configs where **guests** can create tickets or access status. Self-registration enabled also increases risk. No admin access needed.
Q6Is there a public Exp? (PoC/Wild Exploitation)
๐ **Exploit**: **Yes**. Public PoC available via Nuclei templates and Horizon3.ai research. ๐ **Wild Exploitation**: Technical descriptions and attack blogs are public, indicating high risk of automated scanning.
Q7How to self-check? (Features/Scanning)
๐ **Check**: Scan for osTicket versions < 1.18.3 or < 1.17.7. ๐งช **Test**: Use Nuclei template `CVE-2026-22200.yaml` to detect the PDF export vulnerability via crafted HTML injection.
Q8Is it fixed officially? (Patch/Mitigation)
โ **Fixed**: Yes. Official patches released in **v1.18.3** and **v1.17.7**. ๐ฅ **Action**: Upgrade immediately to these versions or later via GitHub releases.
Q9What if no patch? (Workaround)
๐ง **Workaround**: Disable **guest ticket creation** and **self-registration**. Restrict PDF export functionality if possible. Sanitize rich-text inputs strictly until patched.
Q10Is it urgent? (Priority Suggestion)
๐ฅ **Priority**: **CRITICAL**. ๐ **Urgency**: High. Remote code execution (RCE) potential mentioned in Horizon3.ai research. Public exploits exist. Patch immediately to prevent data leakage.