CVE-2026-38446

A session fixation vulnerability has been identified in osTicket v1.18.2, allowing an attacker to hijack a victim’s account by keeping the initial session identifier (OSTSESSID) active after a successful login.

osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing with low-entropy inputs like timestamp and client IP. This allows an attacker to brute-force the key within a feasible time window.

In osTicket versions prior to 1.17.8 and 1.18.4, a logic flaw in password reset token validation causes the expiry check to be performed only when the timestamp lookup fails, allowing reuse of a valid token.

A vulnerability in osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 allows a remote attacker to read arbitrary files from the server via ticket PDF export. The attacker can submit a ticket containing crafted rich-text HTML with PHP filter expressions that are insufficiently sanitized before being processed by the mPDF PDF generator. When the ticket is exported to PDF, the generated file can embed contents of attacker-selected files from the server filesystem as bitmap images, leading to disclosure of sensitive local files in the context of the osTicket application user.

SSRF vulnerability in osTicket before version 1.14.3 allows an attacker to add a malicious file to the server or perform port scanning.

In osTicket before version 1.10.7 and versions 1.12.x before 1.12.1, a stored XSS vulnerability was discovered in setup/install.php. Lack of input sanitization in the firstname and lastname fields allows injection of malicious queries that are then executed.

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1 where CSV formula injection exists in the export spreadsheets functionality. Spreadsheets are generated dynamically from unvalidated user input in the Name and Internal Notes fields in the Users tab, and the Issue Summary field in the tickets tab. This allows agents to download data in .csv or .xls format that may contain malicious formulas.

In osTicket before version 1.12, an XSS vulnerability exists via uploading a crafted CSV file to the User Importer. File contents can appear in an error message, allowing script execution in the browser. This can lead to local file inclusion.

osTicket version 1.10.1 allows uploading 'html' files but does not properly validate the contents of the uploaded files, enabling the upload of arbitrary file types, including malicious ones. An attacker can exploit this vulnerability to upload malicious files to the web application.

In osTicket before 1.10.1, SQL injection is possible by constructing an array via use of square brackets at the end of a parameter name, as demonstrated by the key parameter to file.php.