CVE-2026-38446: osTicket Stored XSS Vulnerability

CVE-2026-38446 Overview

CVE-2026-38446 is a stored cross-site scripting (XSS) vulnerability in osTicket 1.18.3. The flaw resides in the thread entry title field, where user-controlled input is stored without adequate HTML escaping. The unsanitized value is later rendered in multiple staff-facing templates without proper output encoding.

An attacker can inject arbitrary JavaScript by submitting a crafted ticket reply or an email with a malicious subject line. When a staff user opens the ticket in the osTicket agent panel, the payload executes in their browser session. The issue is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Attackers can execute arbitrary JavaScript in the context of authenticated osTicket staff sessions, enabling session theft, agent account takeover, and pivoting into internal support workflows.

Affected Products

osTicket 1.18.3
osTicket staff templates: include/staff/templates/thread-entry.tmpl.php
osTicket staff templates: include/staff/templates/reply-expand.tmpl.php and thread-entries.tmpl.php

Discovery Timeline

2026-08-03 - CVE-2026-38446 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-38446

Vulnerability Analysis

The vulnerability stems from unsafe rendering of the thread entry title property in osTicket 1.18.3. Multiple PHP templates echo $entry->title directly into HTML without passing the value through Format::htmlchars(). Because the title accepts user-controlled input from ticket subjects and reply subjects, an attacker can persist HTML and JavaScript into the database.

When a staff member later views the ticket thread, the malicious markup is rendered inline. The payload executes with the privileges of the authenticated agent, exposing session cookies, CSRF tokens, and administrative actions available in the staff console. Because osTicket accepts tickets via email, the attack does not require an authenticated attacker session.

Root Cause

The unsafe output paths include the truncated title span in thread-entry.tmpl.php at line 84, plus rendering in reply-expand.tmpl.php and thread-entries.tmpl.php. These templates echo the raw string, whereas other title outputs in the codebase are wrapped in Format::htmlchars(). The inconsistent output encoding is the direct root cause.

Attack Vector

An unauthenticated attacker sends an email or submits a ticket where the subject contains a JavaScript payload such as an inline <img> or <script> tag. osTicket stores the subject as the thread entry title. When any staff user opens the ticket in the agent portal, the browser parses and executes the injected script.

php

// Patch: include/client/templates/thread-entry.tmpl.php
            )
        ); ?>
        <span style="max-width:500px" class="faded title truncate"><?php
-           echo $entry->title; ?>
+           echo Format::htmlchars($entry->title); ?>
        </span>
</div>
<div class="thread-body" id="thread-id-<?php echo $entry->getId(); ?>">

// Patch: include/client/templates/thread-export.tmpl.php
    <p style="font-family: sans-serif; padding:0; margin:0; color:<?php echo $color; ?>;">
        <strong><?php echo Format::htmlchars($name); ?></strong>
        <span style="color:#888; font-size:12px; padding-left: 20px;"><?php
-           echo $entry->title;
+           echo Format::htmlchars($entry->title);
        ?>
        </span>
    </p>

Source: osTicket commit 1e39bf1

Detection Methods for CVE-2026-38446

Indicators of Compromise

Ticket subjects or thread entry titles containing HTML tags such as <script>, <img onerror=>, <svg onload=>, or javascript: URIs.
Inbound emails to the osTicket mailbox with subject lines that include angle brackets, event handlers, or encoded script payloads.
Outbound HTTP requests from agent browsers to unfamiliar domains shortly after opening a ticket.
Unexpected staff session activity, including new API tokens or administrative changes made from unusual IPs.

Detection Strategies

Query the osTicket database for thread_entry.title values matching regex patterns for script tags or on[a-z]+= event handlers.
Inspect mail gateway logs for subject lines containing HTML control characters targeting the support address.
Deploy a Content Security Policy (CSP) report-only header on the staff portal to surface inline script violations.
Correlate agent web sessions with anomalous outbound DNS requests using an XDR or SIEM.

Monitoring Recommendations

Enable web server access logging for /scp/tickets.php and alert on referrer or response patterns tied to ticket views immediately preceding suspicious client-side callbacks.
Monitor for agent account privilege changes, password resets, or new administrator creations following ticket views.
Track browser-side telemetry from staff endpoints for unexpected script execution originating from the osTicket domain.

How to Mitigate CVE-2026-38446

Immediate Actions Required

Apply the upstream fix from osTicket commit 1e39bf1, which wraps $entry->title output in Format::htmlchars().
Audit thread_entry rows created since deployment for titles containing HTML or script content and quarantine affected tickets.
Rotate active staff session tokens and force re-authentication for all agent accounts.
Restrict access to the staff portal by IP allowlist while patching is in progress.

Patch Information

The vendor fix is available in the osTicket GitHub repository as commit 1e39bf1cf78fa298285f19b98f6a6dbb6808de19. The patch adds Format::htmlchars() around the vulnerable $entry->title echo statements in the client and staff thread templates. Upgrade beyond osTicket 1.18.3 to the version incorporating this commit, or apply the patch manually to affected template files. Details are documented in the GitHub CVE disclosure.

Workarounds

Manually edit include/staff/templates/thread-entry.tmpl.php, reply-expand.tmpl.php, and thread-entries.tmpl.php to wrap $entry->title in Format::htmlchars() until an official upgrade is applied.
Deploy a Content Security Policy that disallows inline scripts on the staff console, for example Content-Security-Policy: default-src 'self'; script-src 'self'.
Configure a web application firewall rule to strip or reject inbound email subjects and ticket titles containing HTML tags or event handler attributes.

bash

# Nginx configuration example: enforce CSP on the osTicket staff portal
location /scp/ {
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;
}