CVE-2026-22200

GitHubCurated repository PoCStubC++SecureWithUmer/CVE-2026-PoCs

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact provides a Docker-based lab environment for osTicket 1.18.1, intended for defensive validation and secure configuration testing related to CVE-2026-22200. It contains no exploit, scanner, or substantive technical analysis code. The files only set up the vulnerable application and describe how to run it, without any code to exercise, detect, or analyze the vulnerability.

Backdoor review

No backdoor observed in reviewed code

The artifact contains a Docker-based lab environment for osTicket 1.18.1, intended for defensive validation of CVE-2026-22200. All four text files (Dockerfile, README.md, compose.yaml, entrypoint.sh) are standard infrastructure-as-code and documentation. No backdoor, deceptive payload, or concealed harmful behavior is present.

ClassificationStub
Model confidence95%
AuthenticationUnknown
LanguagesDockerfileShellYAMLMarkdown
Target softwareosTicket
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains only infrastructure code (Dockerfile, compose.yaml, entrypoint.sh) and documentation (README.md) to deploy a vulnerable osTicket instance. There is no exploit code, no scanner logic, and no technical writeup analyzing the vulnerability. The README explicitly states the lab is for 'defensive validation and hardening practice' and does not include any PoC or detection code. The packet reports complete_artifact_coverage, confirming no other files exist. Therefore, the artifact is a stub.

Remnant-DB-CVE-2026-22200-a0d1333/README.md:1-9Remnant-DB-CVE-2026-22200-a0d1333/Dockerfile:1-46Remnant-DB-CVE-2026-22200-a0d1333/compose.yaml:1-42Remnant-DB-CVE-2026-22200-a0d1333/entrypoint.sh:1-25

Observed behavior

  • Builds a Docker image for osTicket 1.18.1 with Apache and PHP 8.2.Remnant-DB-CVE-2026-22200-a0d1333/Dockerfile:1-46
  • Defines a Docker Compose service for the osTicket lab and a MariaDB database.Remnant-DB-CVE-2026-22200-a0d1333/compose.yaml:1-42
  • Provides a startup script that copies the sample configuration and starts Apache.Remnant-DB-CVE-2026-22200-a0d1333/entrypoint.sh:1-25
  • README describes the lab as for defensive validation and hardening practice, with instructions to start and stop the environment.Remnant-DB-CVE-2026-22200-a0d1333/README.md:1-111
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Infrastructure
Docker Compose lab for osTicket 1.18.1 with MariaDBThe lab sets up a vulnerable osTicket instance for local security testing, consistent with the stated CVE-2026-22200 educational purpose.Remnant-DB-CVE-2026-22200-a0d1333/compose.yaml:1-42Remnant-DB-CVE-2026-22200-a0d1333/Dockerfile:1-46
Credential
Database password P@ssw0rd123! and root password rootpass_change_meHardcoded credentials are for a local lab environment and are explicitly documented; they do not indicate a backdoor.Remnant-DB-CVE-2026-22200-a0d1333/compose.yaml:29-32Remnant-DB-CVE-2026-22200-a0d1333/README.md:73-76
Review boundaries

What the analysis did not establish

  • Evidence is limited to the four text files provided; no other files exist in the artifact. The artifact does not contain any exploit, scanner, or writeup code, so classification is based solely on the absence of such content.
  • Only the four text files in the evidence packet were reviewed; no binary files were present or analyzed.
  • The review does not verify the safety of the osTicket application itself or the Docker base images, only the supplied PoC files.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

2026/CVE-2026-22200/Remnant-DB-CVE-2026-22200-a0d1333/compose.yaml

Created Vuln labCVE-2026-22200Compose · mixed

1 Compose manifest · 1 Dockerfile · 2 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A containerized lab environment for osTicket 1.18.1, consisting of a PHP/Apache web service and a MariaDB database, intended for defensive validation and secure configuration testing.

2026/CVE-2026-22200/Remnant-DB-CVE-2026-22200-a0d1333/compose.yaml:1-422026/CVE-2026-22200/Remnant-DB-CVE-2026-22200-a0d1333/README.md:1-3

Lab assessment

Vulnerability lab

The README explicitly states the lab is for 'CVE-2026-22200' and 'defensive validation and hardening practice', and the directory path includes 'CVE-2026-22200', indicating a vulnerability research purpose.

2026/CVE-2026-22200/Remnant-DB-CVE-2026-22200-a0d1333/README.md:1-32026/CVE-2026-22200/Remnant-DB-CVE-2026-22200-a0d1333/README.md:7
Lab shapeCompose · mixed
Services2
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

lab

web applicationosTicket 1.18.1

A PHP 8.2 Apache container built from a local Dockerfile that downloads and installs osTicket 1.18.1. It exposes port 80 on the container, mapped to host port 8080, and connects to the 'db' service using environment variables.

2026/CVE-2026-22200/Remnant-DB-CVE-2026-22200-a0d1333/compose.yaml:2-202026/CVE-2026-22200/Remnant-DB-CVE-2026-22200-a0d1333/Dockerfile:1-46

db

databaseMariaDB 11.4

A MariaDB 11.4 container with a healthcheck, persistent volume for data, and pre-configured database and user credentials for osTicket.

2026/CVE-2026-22200/Remnant-DB-CVE-2026-22200-a0d1333/compose.yaml:22-38

entrypoint.sh

startup scriptconfiguration initializer

A bash script copied into the 'lab' container that displays a lab objective banner, copies a sample osTicket configuration file if missing, sets permissions, and starts Apache.

2026/CVE-2026-22200/Remnant-DB-CVE-2026-22200-a0d1333/entrypoint.sh:1-252026/CVE-2026-22200/Remnant-DB-CVE-2026-22200-a0d1333/Dockerfile:42-45
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-22200

Insufficient evidence

The packet associates the lab with CVE-2026-22200 via the directory path and README title, but provides no details about the vulnerability, its mechanism, or how the lab demonstrates it. No exploit code, vulnerable code, or CVE description is included.

2026/CVE-2026-22200/Remnant-DB-CVE-2026-22200-a0d1333/README.md:12026/CVE-2026-22200/Remnant-DB-CVE-2026-22200-a0d1333/compose.yaml:1
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker Engine or Docker Desktop with Docker Compose v2, or Podman 4+ with compose support.2026/CVE-2026-22200/Remnant-DB-CVE-2026-22200-a0d1333/README.md:15-22
  • Outbound network access to download osTicket zip from GitHub releases during build.2026/CVE-2026-22200/Remnant-DB-CVE-2026-22200-a0d1333/Dockerfile:42026/CVE-2026-22200/Remnant-DB-CVE-2026-22200-a0d1333/Dockerfile:33
  • Manual completion of the osTicket setup wizard at http://127.0.0.1:8080/setup/ using the provided database credentials.2026/CVE-2026-22200/Remnant-DB-CVE-2026-22200-a0d1333/README.md:63-72

Evidence-described exercise path

  1. Start the lab using 'docker compose -f compose.yaml up --build -d' or the Podman equivalent.2026/CVE-2026-22200/Remnant-DB-CVE-2026-22200-a0d1333/README.md:47-55
  2. Open the osTicket setup page at http://127.0.0.1:8080/setup/ and complete the installation wizard using the specified database connection details.2026/CVE-2026-22200/Remnant-DB-CVE-2026-22200-a0d1333/README.md:63-72
  3. Verify the services are running with 'docker compose ps' and 'docker compose logs'.2026/CVE-2026-22200/Remnant-DB-CVE-2026-22200-a0d1333/README.md:76-79
  4. Perform defensive validation and hardening practice on the osTicket instance (implied by the lab objective).2026/CVE-2026-22200/Remnant-DB-CVE-2026-22200-a0d1333/entrypoint.sh:4-62026/CVE-2026-22200/Remnant-DB-CVE-2026-22200-a0d1333/README.md:7
  5. Stop and clean up the lab using 'docker compose down', optionally with '-v' to remove the database volume.2026/CVE-2026-22200/Remnant-DB-CVE-2026-22200-a0d1333/README.md:85-92
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is confined to the lab's own containers. The lab exposes only port 8080 to the host for local access, uses standard Docker volumes, and does not mount the Docker socket, run in privileged mode, or execute any hidden or destructive actions. The entrypoint script only initializes osTicket configuration and starts Apache.

2026/CVE-2026-22200/Remnant-DB-CVE-2026-22200-a0d1333/compose.yaml:1-422026/CVE-2026-22200/Remnant-DB-CVE-2026-22200-a0d1333/entrypoint.sh:1-25
Review boundaries

What the analysis did not establish

  • No exploit code, vulnerable code, or CVE description is provided; the association with CVE-2026-22200 is based solely on directory naming and README title.
  • The osTicket application itself is downloaded from an external URL at build time; its contents are not inspected in this packet.
  • The lab requires manual completion of the setup wizard, which is not automated and may involve additional steps not documented.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1