CVE-2026-38444

MEDIUM

osTicket 1.18.3 - Unauthenticated Stored Cross-Site Scripting via Email From Display Name

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-38444. PoCs published by fr3akhacks.

AI-analyzed exploit summary The repository contains detailed technical writeups for three osTicket vulnerabilities (CVE-2026-38444, CVE-2026-38446, CVE-2026-38447). The analysis includes root cause breakdowns, affected components, patch recommendations, and CVSS scoring, but no functional exploit code. Focuses on stored XSS via email headers/titles and weak API key generation.

Description

osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) via the email From-header display name. The value is extracted without sanitization in include/class.mailparse.php and stored raw in the poster field of ost_thread_entry. When an unauthenticated attacker sends a reply email to an existing ticket from an unregistered address with an XSS payload in the From display name.

Exploits (1)

nomisec WRITEUP

by fr3akhacks · poc

https://github.com/fr3akhacks/cve-disclosures

View Code ZIP pw:eip

The repository contains detailed technical writeups for three osTicket vulnerabilities (CVE-2026-38444, CVE-2026-38446, CVE-2026-38447). The analysis includes root cause breakdowns, affected components, patch recommendations, and CVSS scoring, but no functional exploit code. Focuses on stored XSS via email headers/titles and weak API key generation.

Classification

Writeup 100%

Attack Type

Xss | Info Leak

Complexity

Moderate

Reliability

Reliable

Target: osTicket <= 1.18.3

No auth needed

Prerequisites: For XSS: Ability to send crafted emails to osTicket (CVE-2026-38444/CVE-2026-38446) · For API key weakness: Knowledge of approximate key creation time/IP (CVE-2026-38447)

MITRE ATT&CK

T1059.007 - JavaScript T1189 - Drive-by Compromise T1005 - Data from Local System T1552 - Unsecured Credentials

mistral-large-3 · analyzed Aug 04, 2026 Full analysis →