CVE-2026-36214: osTicket Stored XSS Vulnerability

CVE-2026-36214 Overview

CVE-2026-36214 is a stored cross-site scripting (XSS) vulnerability affecting osTicket, an open-source support ticket system. The flaw exists in osTicket versions 1.10 through 1.17.7 and 1.18.0 through 1.18.3. The vulnerability stems from a Bootstrap Tooltip component combined with insufficient HTML sanitization in the ticket rendering pipeline. Remote authenticated attackers can inject malicious JavaScript that executes in the browser session of an Agent or Admin viewing the affected content. Successful exploitation can lead to session hijacking, unauthorized ticket manipulation, and privilege escalation within the helpdesk environment. The issue is tracked as CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers can execute arbitrary JavaScript in privileged Agent or Admin sessions, enabling session theft, unauthorized ticket actions, and lateral compromise of the helpdesk platform.

Affected Products

osTicket versions 1.10 through 1.17.7
osTicket versions 1.18.0 through 1.18.3
Deployments using the vulnerable Bootstrap Tooltip component with unsanitized HTML input

Discovery Timeline

2026-07-14 - CVE-2026-36214 published to the National Vulnerability Database
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-36214

Vulnerability Analysis

The vulnerability resides in osTicket's HTML sanitization routine within include/class.format.php. Ticket content and other user-submitted HTML pass through a series of regular expression filters designed to strip dangerous attributes and elements before rendering. The pre-patch filter set failed to properly neutralize attributes consumed by the Bootstrap Tooltip component. Because Bootstrap Tooltip can render HTML content from specific attributes, an attacker submitting a crafted ticket, response, or other rich-text field can embed markup that survives sanitization. When an Agent or Admin later views the ticket in the staff interface, the tooltip triggers execution of attacker-controlled JavaScript in the authenticated staff session.

Root Cause

The root cause is incomplete attribute filtering in Format::safe_html(). The sanitizer used a mismatched pair of pattern and replacement arrays, and the data-cid attribute stripping rule was inconsistent with related handling for Bootstrap-recognized data-* attributes. This left tooltip-related data attributes intact, allowing attacker-controlled HTML to be interpreted by the Bootstrap component when the DOM was hydrated on the staff side.

Attack Vector

An attacker with the ability to submit content into osTicket — including unauthenticated users where public ticket submission is enabled — sends a payload containing HTML that leverages Bootstrap Tooltip data attributes. The payload is stored in the database and rendered when a privileged user views it. Because the script executes within the Agent or Admin origin, it can call authenticated osTicket endpoints, exfiltrate session cookies, modify configuration, or create new administrative accounts.

php

// Security patch in include/class.format.php
// Source: https://github.com/osTicket/osTicket/commit/5afdf5450ff5c7d218447014b7abbb5f1e6dd42f
                   ':<html[^>]+:i',              # drop html attributes
                   ':<(a|span) (name|style)="(mso-bookmark\:)?_MailEndCompose">(.+)?<\/(a|span)>:', # Drop _MailEndCompose
                   ':<div dir=(3D)?"ltr">(.*?)<\/div>(.*):is', # drop Gmail "ltr" attributes
-                  ':data-cid="[^"]*":',         # drop image cid attributes
                   '(position: ?(-webkit-)?(static|relative|fixed|absolute|sticky|initial|inherit);?)', # Position styling
                   ':[\x{2002}-\x{200B}]+:u',    # unicode spaces
             ),
-            array('', '', '', '', '<html', '$4', '$2 $3', '', '', ' '),
+            array('', '', '', '', '<html', '$4', '$2 $3', '', ' '),
             $html);

The fix realigns the pattern and replacement arrays used by preg_replace, ensuring that filter rules operate on the intended attributes and that residual tooltip-triggering markup is stripped. A proof-of-concept is available in the public GitHub repository for CVE-2026-36214.

Detection Methods for CVE-2026-36214

Indicators of Compromise

Ticket bodies, thread entries, or knowledge base articles containing Bootstrap data-toggle="tooltip", data-html="true", or data-original-title attributes with embedded HTML or script fragments.
Outbound HTTP requests from staff browsers to unknown domains immediately after opening a ticket in the Agent or Admin panel.
Unexpected creation of Admin accounts or modification of agent permissions correlated with a specific ticket view event.

Detection Strategies

Query the osTicket database for stored HTML fields containing suspicious data-* tooltip attributes or inline event handlers such as onerror= and onmouseover=.
Review web server access logs for POST requests to ticket submission endpoints containing URL-encoded <script> or data-toggle payloads.
Compare the deployed include/class.format.php against the fixed version at commit 5afdf5450ff5c7d218447014b7abbb5f1e6dd42f to confirm patch status.

Monitoring Recommendations

Enable web application firewall rules that flag stored XSS patterns targeting Bootstrap tooltip attributes on osTicket submission endpoints.
Monitor staff session activity for anomalous API calls originating shortly after ticket views, particularly account and permission changes.
Log and alert on outbound network requests from browsers used by helpdesk agents to non-approved destinations.

How to Mitigate CVE-2026-36214

Immediate Actions Required

Upgrade to osTicket 1.17.8 or osTicket 1.18.4, which contain the patched sanitizer.
Audit recent tickets, thread entries, and knowledge base articles for injected tooltip attributes and remove malicious content.
Rotate Agent and Admin session cookies and force password resets for any accounts that opened suspicious tickets.

Patch Information

The vendor addressed the issue in the upstream commit 5afdf5450ff5c7d218447014b7abbb5f1e6dd42f. The fix is included in the osTicket v1.17.8 and osTicket v1.18.4 releases. Additional vendor information is available from EnhanceSoft and the osTicket project site.

Workarounds

Restrict public ticket submission to authenticated portal users where feasible, reducing the anonymous attack surface.
Deploy a Content Security Policy (CSP) that disallows inline scripts on the staff interface to limit the impact of injected payloads.
Place osTicket behind a web application firewall with rules blocking Bootstrap tooltip attribute injection and common XSS vectors until patching is complete.

bash

# Example: upgrade an existing osTicket 1.18.x deployment to the patched release
cd /var/www/osticket
wget https://github.com/osTicket/osTicket/releases/download/v1.18.4/osTicket-v1.18.4.zip
unzip -o osTicket-v1.18.4.zip -d /tmp/osticket-1.18.4
cp -R /tmp/osticket-1.18.4/upload/* /var/www/osticket/
php /var/www/osticket/scripts/manage-updates.php upgrade