Exploit for CVE-2026-22200 Targets osTicket PDF Export Functionality

## Overview A weaponized exploit for CVE-2026-22200 has emerged, targeting Enhancesoft osTicket. This vulnerability allows remote attackers to read arbitrary files from the server through the ticket PDF export functionality. The exploit leverages crafted rich-text HTML that includes insufficiently sanitized PHP filter expressions. ## Technical Details The vulnerability exists in osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7. Attackers can submit tickets containing malicious HTML. When exported to PDF, the mPDF generator processes this HTML, allowing the inclusion of contents from selected server files as bitmap images in the PDF. This process can expose sensitive information stored on the server. ## Impact The exploit is particularly dangerous in default configurations. If guest ticket creation is enabled or self-registration is allowed, attackers can easily exploit this vulnerability. The result is the potential disclosure of sensitive local files, compromising the confidentiality of the osTicket application user’s environment. ## Mitigation Defenders should upgrade to osTicket version 1.18.3 or 1.17.7 immediately to close this vulnerability. Additionally, organizations should review user permissions and consider disabling guest ticket submissions and self-registration until the upgrade is complete. Regularly auditing and monitoring ticket submissions can also help detect any malicious activity.