CVE-2026-22200: osTicket File Read Vulnerability

CVE-2026-22200 Overview

Enhancesoft osTicket versions up to and including 1.18.2 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filter expressions which are insufficiently sanitized before being processed by the mPDF PDF generator during export. When the attacker exports the ticket to PDF, the generated PDF can embed the contents of attacker-selected files from the server filesystem as bitmap images, allowing disclosure of sensitive local files in the context of the osTicket application user.

Critical Impact

This vulnerability allows unauthenticated remote attackers to read arbitrary files from the server filesystem, potentially exposing sensitive configuration files, database credentials, and application secrets.

Affected Products

• Enhancesoft osTicket versions up to and including 1.18.2
• osTicket installations with default configurations where guests may create tickets
• osTicket deployments where self-registration is enabled

Discovery Timeline

• 2026-01-12 - CVE CVE-2026-22200 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2026-22200

Vulnerability Analysis

This vulnerability stems from improper neutralization of special elements used in an expression (CWE-74). The osTicket application's PDF export functionality relies on the mPDF library to generate PDF documents from ticket content. However, the application fails to adequately sanitize rich-text HTML content submitted within tickets before passing it to the mPDF renderer.

The mPDF library supports certain PHP filter wrapper expressions and embedded content directives. When an attacker crafts a ticket containing malicious HTML with embedded PHP filter expressions or file reference directives, these are processed by mPDF during PDF generation. The resulting PDF document embeds the contents of server-side files as bitmap images, effectively exfiltrating their contents to the attacker.

This issue is particularly concerning because it is exploitable in default osTicket configurations. Guest users who can create tickets and access ticket status, or environments with self-registration enabled, provide sufficient access for exploitation without any authentication.

Root Cause

The root cause is insufficient input sanitization in the ticket PDF export workflow. The osTicket application does not properly filter or escape PHP filter expressions and file reference directives from user-supplied rich-text HTML content before passing it to the mPDF library for PDF rendering. The mPDF library interprets these directives and processes the referenced files, embedding their contents in the output PDF.

Attack Vector

The attack is network-based and requires no user interaction or special privileges. An attacker can exploit this vulnerability by:

1. Creating a new support ticket through the osTicket web interface (as a guest or registered user)
2. Inserting crafted rich-text HTML containing PHP filter expressions that reference sensitive server files
3. Submitting the ticket to the osTicket system
4. Requesting the PDF export of the submitted ticket
5. Downloading the generated PDF which now contains the embedded contents of the targeted server files as images

The attack can target critical files such as /etc/passwd, osTicket configuration files containing database credentials (include/ost-config.php), or other sensitive application data accessible to the web server user.

The vulnerability mechanism involves the mPDF library processing specially crafted HTML content. Attackers embed directives within ticket content that cause mPDF to read local files and embed their contents in the generated PDF. For detailed technical information, refer to the VulnCheck Advisory on osTicket.

Detection Methods for CVE-2026-22200

Indicators of Compromise

• Unusual PDF export requests with large or unexpected file sizes in web server logs
• Tickets containing suspicious HTML content with PHP filter wrapper patterns or unusual embedded directives
• Multiple rapid PDF export requests from a single source IP address
• Web application firewall alerts for PHP wrapper or file inclusion patterns in POST data

Detection Strategies

• Monitor web server access logs for excessive or unusual requests to PDF export endpoints (e.g., /ajax.php/tickets/*/pdf)
• Implement content inspection rules to detect PHP filter expressions and file reference patterns in ticket submission data
• Deploy Web Application Firewall (WAF) rules to block requests containing known malicious mPDF directives
• Review osTicket ticket content for HTML containing file://, php://filter, or similar URI schemes

Monitoring Recommendations

• Enable verbose logging for osTicket ticket creation and PDF export operations
• Configure SIEM alerting for patterns associated with file disclosure attempts in web application logs
• Monitor file access patterns for the osTicket application user to detect unusual file reads
• Implement anomaly detection for PDF export request patterns and response sizes

How to Mitigate CVE-2026-22200

Immediate Actions Required

• Upgrade osTicket to a patched version when available from osTicket Official Website
• Disable guest ticket creation and self-registration if not required for business operations
• Restrict PDF export functionality to trusted administrative users only
• Implement input validation at the web server or WAF level to filter potentially malicious HTML patterns

Patch Information

Organizations should monitor the GitHub osTicket Repository for security updates addressing this vulnerability. Review the VulnCheck Advisory on osTicket for additional remediation guidance.

Workarounds

• Disable the PDF export feature by removing or restricting access to the relevant PHP scripts until a patch is applied
• Implement strict content security policies that filter user-submitted HTML before storage
• Use a web application firewall (WAF) to block requests containing PHP filter wrapper patterns and file reference directives
• Restrict osTicket application user filesystem permissions to minimize accessible sensitive files

# Example Apache configuration to restrict PDF export access
<Location "/ajax.php">
    <If "%{QUERY_STRING} =~ /pdf/">
        Require ip 10.0.0.0/8
        Require ip 192.168.0.0/16
    </If>
</Location>