CVE-2026-35009: Open ISES Tickets XSS Vulnerability

CVE-2026-35009 Overview

CVE-2026-35009 is a reflected cross-site scripting (XSS) vulnerability in Open ISES Tickets versions prior to 3.44.2. The flaw resides in add_note.php, where the ticket_id GET parameter is written into a hidden HTML input field's VALUE attribute without sanitization. Authenticated attackers can craft a URL containing a JavaScript payload in ticket_id that executes in the victim's browser when the link is visited. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Successful exploitation enables arbitrary JavaScript execution in an authenticated user's session, exposing the ticketing interface to session theft, action forgery, and content tampering.

Affected Products

Open ISES Tickets versions before 3.44.2
add_note.php component handling the ticket_id GET parameter
Fixed release: Open ISES Tickets v3.44.2

Discovery Timeline

2026-05-20 - CVE-2026-35009 published to NVD
2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-35009

Vulnerability Analysis

The vulnerability is a reflected XSS issue in the add_note.php endpoint of Open ISES Tickets. The application reads the ticket_id value from the query string and writes it directly into a hidden input element's VALUE attribute in the rendered HTML response. Because output encoding is not applied, an attacker can break out of the attribute context by injecting a closing quote followed by additional HTML or event handlers. The payload reflects back into the response and executes within the victim's browser under the origin of the Open ISES Tickets application.

Root Cause

The root cause is missing output encoding of user-controlled input prior to insertion into an HTML attribute. The ticket_id parameter is treated as trusted data and concatenated into the page template. No context-aware escaping, allowlist validation, or type enforcement is applied, which violates the safe output handling expected for CWE-79. The fix in v3.44.2 introduces proper sanitization on the parameter before it is reflected, as recorded in the GitHub Commit Update.

Attack Vector

Exploitation requires an authenticated session and user interaction. An attacker delivers a crafted link pointing to add_note.php with a malicious ticket_id payload. When the authenticated victim opens the URL, the injected script executes in the application's origin. Attackers can use this primitive to read session data, perform actions on behalf of the user, or stage further attacks against ticket data. Additional technical context is documented in the VulnCheck Advisory on Reflected XSS.

The vulnerability mechanism is described above in prose. No verified public proof-of-concept code is referenced in the advisory data.

Detection Methods for CVE-2026-35009

Indicators of Compromise

Web server access logs showing requests to add_note.php with ticket_id values containing characters such as ", <, >, or substrings like script, onerror, onload, or javascript:.
Referrer headers pointing to external domains immediately preceding suspicious add_note.php requests.
Outbound browser requests from authenticated user sessions to attacker-controlled domains shortly after visiting the ticketing application.

Detection Strategies

Deploy web application firewall rules that flag reflected XSS payload patterns in the ticket_id query parameter.
Inspect HTTP response bodies for echoed ticket_id values that contain unencoded HTML metacharacters inside attribute contexts.
Correlate authenticated user sessions with anomalous client-side behavior such as unexpected DOM modifications or unusual API calls originating from the ticketing UI.

Monitoring Recommendations

Enable verbose request logging on the Open ISES Tickets web tier and retain logs for forensic review.
Monitor for phishing campaigns delivering URLs that target the add_note.php endpoint of internal ticketing systems.
Alert on Content Security Policy (CSP) violation reports referencing inline script execution on ticketing pages.

How to Mitigate CVE-2026-35009

Immediate Actions Required

Upgrade Open ISES Tickets to version 3.44.2 or later using the GitHub Release v3.44.2.
Restrict access to the ticketing application to trusted networks or VPN users until patching completes.
Instruct users to avoid clicking unsolicited links that reference add_note.php with unusual ticket_id values.

Patch Information

The vendor addressed the issue in Open ISES Tickets v3.44.2. The remediation commit applies sanitization to the ticket_id parameter before it is rendered into the hidden input attribute. Review the change set in the GitHub Commit Update and deploy the corresponding release.

Workarounds

Deploy a web application firewall rule that blocks requests where ticket_id contains HTML metacharacters such as <, >, or quote characters.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to known origins.
Configure session cookies with HttpOnly and SameSite=Strict attributes to limit the impact of script execution.

bash

# Example WAF rule (ModSecurity) blocking suspicious ticket_id values
SecRule ARGS:ticket_id "@rx (?i)(<|>|\"|script|onerror|onload|javascript:)" \
    "id:1035009,phase:2,deny,status:403,\
    msg:'Possible CVE-2026-35009 XSS payload in ticket_id',\
    tag:'CWE-79'"