High · published January 12, 2026
CVSS calls it high at 8.7. It sits in the 99.5th percentile for exploit probability.
⚡ An arbitrary file read vulnerability lurks in osTicket versions 1.18.x and 1.17.x, and it’s as sneaky as a cat burglar slipping into your house through an open window! Think of osTicket as a restaurant, and the ticket PDF export functionality as their takeout service. If a diners' order slips in a secret ingredient (like malicious HTML), the kitchen (mPDF generator) might unknowingly serve up a dish that reveals hidden recipes (sensitive files) instead of the intended meal. This vulnerability allows a remote attacker to craft a ticket that, when exported to PDF, can reveal any sensitive file on the server’s filesystem. Basically, an attacker can sneak in and grab crucial data, which could lead to devastating breaches of privacy and security for users.
Think of osTicket as a restaurant, and the ticket PDF export functionality as their takeout service. If a diners' order slips in a secret ingredient (like malicious HTML), the kitchen (mPDF generator) might unknowingly serve up a dish that reveals hidden recipes (sensitive files) instead of the intended meal. The flaw exists in how osTicket processes rich-text HTML for PDF exports. It fails to properly sanitize PHP filter expressions, enabling attackers to embed and export the contents of sensitive files as images in the generated PDFs.
This vulnerability allows a remote attacker to craft a ticket that, when exported to PDF, can reveal any sensitive file on the server’s filesystem. Basically, an attacker can sneak in and grab crucial data, which could lead to devastating breaches of privacy and security for users. To safeguard your system, immediately upgrade to osTicket version 1.18.3 or 1.17.7. Additionally, ensure that your configurations limit ticket creation to authenticated users, and consider disabling guest access or self-registration for ticket submissions. You've got this! By following these steps, you're on your way to fortifying your osTicket implementation and ensuring your data stays safe! 🛡️