CVE-2026-22200

osTicket versions 1.18.x before 1.18.3 and 1.17.x before 1.17.7 contain an arbitrary file read in the ticket PDF export feature: rich-text HTML submitted in a ticket can carry PHP filter expressions that are insufficiently sanitized before being processed by the embedded mPDF PDF generator. An attacker triggers the flaw by submitting a crafted ticket and then exporting that ticket to PDF, at which point the generated PDF embeds the contents of attacker-chosen files from the server filesystem as bitmap images. This yields disclosure of sensitive local files readable by the osTicket application user, and the public technical analysis (Horizon3's 'ticket to shell' writeup) indicates the PHP filter primitive can be pushed toward remote code execution. Affected organizations are those running the listed osTicket versions in default configurations that allow guests to create tickets and view ticket status, or with self-registration enabled. No confirmed in-the-wild exploitation or KEV listing is known yet, but a public PoC exists and EPSS assigns a 73.9% probability of exploitation within 30 days.

What to do: Upgrade to osTicket 1.18.3 (on the 1.18.x branch) or 1.17.7 (on the 1.17.x branch), which contain the fix. Until patched, restrict guest ticket creation and ticket-status access or disable ticket PDF export, and audit for tickets containing php://filter-style expressions in rich text along with anomalous PDF export activity. Given the public PoC and high EPSS score, treat this as likely to be exploited in the near term.