CVE-2026-22200

What it actually does

The vulnerability is an arbitrary local file read in osTicket's ticket PDF export path. Crafted rich-text HTML submitted in a ticket can reference PHP stream/filter expressions that are not sufficiently sanitized before mPDF processes embedded image content. During PDF generation, mPDF attempts to resolve the attacker-controlled reference and can cause contents of local files readable by the osTicket application user to be embedded into the generated PDF, exposing configuration files, credentials, application source, logs, or other sensitive filesystem data. The issue affects osTicket 1.18.x before 1.18.3 and 1.17.x before 1.17.7, including vulnerable Git revisions prior to fix commit 2570d69892775fff5df40a7540e507131a0975ad.

Why it matters to the business

Successful exploitation can expose helpdesk configuration secrets, database credentials, mail credentials, API tokens, private customer-support data, and operational logs. Because default configurations may allow guests to create tickets and later access ticket status, exploitation can be possible without a privileged account. The vulnerability has weaponized exploit maturity and a high EPSS score, and it has been public for 210 days, so internet-facing osTicket deployments should be treated as high-priority exposure even though it is not currently listed in CISA KEV and is not specifically marked as ransomware-used.

How an attack unfolds

An attacker identifies an osTicket instance that allows guest ticket submission, ticket status access, or self-registration. The attacker submits a ticket containing crafted rich-text HTML that includes an embedded image or similar resource reference using a PHP filter/stream expression aimed at a local file. When the attacker, or a workflow reachable by the attacker, triggers ticket PDF export, osTicket passes the ticket content to mPDF. Because the malicious reference is not adequately rejected, mPDF resolves the local file in the context of the web application process and renders the result into the exported PDF as image data. The attacker downloads the PDF and extracts or visually reads the embedded file contents. They may repeat the process for common application configuration paths, logs, source files, and credential locations to support deeper compromise.

How to fix it

Upgrade affected osTicket deployments to 1.18.3 or later for the 1.18 branch, or 1.17.7 or later for the 1.17 branch. For Git-based deployments, ensure the codebase includes fix commit 2570d69892775fff5df40a7540e507131a0975ad or a later upstream revision. After upgrading, clear application/PDF generation caches and restart PHP-FPM or the web server as appropriate. As interim mitigations, disable or restrict guest ticket creation and self-registration where not required, restrict ticket PDF export to trusted authenticated staff, block PHP stream wrapper patterns in submitted rich-text content, and apply web application firewall rules for PHP filter-wrapper strings in ticket submissions. Ensure the osTicket process runs with least-privilege filesystem permissions so it cannot read secrets outside the application’s required runtime scope.

How to confirm the fix worked

Confirm the installed osTicket version is 1.18.3 or later, 1.17.7 or later, or that the deployed Git revision contains commit 2570d69892775fff5df40a7540e507131a0975ad. Review the PDF export code path and sanitizer behavior to verify PHP stream wrappers and filter expressions are rejected or neutralized before mPDF processes rich-text content. Test in a non-production environment with a benign local test file and confirm crafted rich-text references are not rendered into exported PDFs. Validate that guest ticket submission, self-registration, and PDF export permissions match business requirements. Check web server, PHP, and application logs for rejected requests after mitigation to ensure controls are active and not silently bypassed.

Typical attack path

1. Discover an internet-facing osTicket deployment and determine that guest ticket creation, ticket-status access, or self-registration is enabled.
2. Create or access a ticket containing crafted rich-text HTML with a PHP stream/filter reference in content that will be processed by the PDF export function.
3. Trigger PDF export for the ticket through the available user or guest workflow.
4. Download the generated PDF and inspect embedded content for leaked local file data.
5. Iterate against likely readable files such as application configuration, web server logs, mail configuration, environment files, and source code.
6. Use recovered secrets or operational data for follow-on access, credential replay, database access, or further reconnaissance.

How to detect it

To determine whether exploitation already occurred, review web server access logs, reverse proxy logs, WAF logs, PHP-FPM logs, osTicket application logs, and ticket content history for PHP stream-wrapper strings in ticket submissions or updates. Correlate suspicious ticket creation or message-update requests with subsequent PDF export or print/download actions against the same ticket, especially from the same IP address, session, or newly created account. Search request bodies, captured WAF events, and application audit records for URL-encoded or HTML-encoded variants of PHP filter expressions. Review PHP and web server error logs for mPDF image-processing errors, failed file reads, unsupported image warnings, or references to local filesystem paths during PDF export. Inspect generated PDFs and PDF/cache/temp directories for files created around suspicious requests, and check whether any contain recognizable local file content such as application configuration, passwd-style account listings, environment variables, or log data. If indicators are found, assume sensitive files readable by the web application account may have been disclosed and rotate affected secrets.

• php://filter
• php%3A%2F%2Ffilter
• pHp://FilTer
• convert.base64-encode
• convert%2Ebase64-encode
• resource=
• resource%3D
• php://filter/convert.base64-encode/resource=
• php%3A%2F%2Ffilter%2Fconvert%2Ebase64-encode%2Fresource%3D
• data:image
• <img src="php://filter
• <img src='php://filter
• src=php://filter
• src="php://filter
• src='php://filter
• /etc/passwd
• /etc/hosts
• /proc/self/environ
• .env
• include/ost-config.php
• ost-config.php
• mPDF
• Failed to load image
• Image error
• Unable to get image size
• stream_filter_append
• allow_url_fopen
• allow_url_include

What your security team should do

• Patch or upgrade all affected osTicket instances immediately, prioritizing internet-facing deployments and deployments that allow guest ticket creation or self-registration.
• Temporarily disable public ticket PDF export or restrict it to trusted staff until the fixed version is confirmed in production.
• Hunt historical ticket submissions and web requests for PHP stream/filter wrapper patterns, especially followed by PDF export activity from the same ticket or session.
• Rotate secrets that may be readable by the osTicket application user, including database credentials, SMTP credentials, API tokens, and integration keys, if exploitation is suspected.
• Review generated PDFs, PDF caches, and temporary mPDF files for embedded sensitive local file content.
• Apply least-privilege filesystem permissions to the web application account and remove unnecessary read access to configuration backups, logs, and secrets.
• Add SIEM and WAF detections for PHP wrapper strings in ticket body fields, rich-text HTML, and URL-encoded request bodies.
• Because exploit maturity is weaponized and EPSS is high, treat unpatched public deployments as likely targeted even without current KEV listing.