CVE-2026-38446

MEDIUM

osTicket 1.18.3 - Stored Cross-Site Scripting via Thread Entry Title Field

Title source: llm

Description

A stored cross-site scripting (XSS) vulnerability exists in osTicket 1.18.3 due to improper sanitization of the thread entry title field. User-controlled input in the title is stored without adequate HTML escaping and later rendered in multiple staff-facing templates without proper output encoding. An attacker can inject arbitrary JavaScript by submitting a crafted ticket reply or email with a malicious subject line.

References (5)

Core 5

Core References

https://github.com/osTicket/osTicket/blob/v1.18.3/include/staff/templates/thread-entry.tmpl.php#L84

View Writeup ZIP pw:eip

https://github.com/osTicket/osTicket/blob/v1.18.3/include/staff/templates/thread-entries.tmpl.php

View Writeup ZIP pw:eip

https://github.com/osTicket/osTicket/blob/v1.18.3/include/staff/templates/reply-expand.tmpl.php

https://github.com/fr3akhacks/cve-disclosures/blob/master/osTicket/CVE-2026-38446.md

View Writeup ZIP pw:eip

https://github.com/osTicket/osTicket/commit/1e39bf1cf78fa298285f19b98f6a6dbb6808de19

View Patch ZIP pw:eip

Scores

CVSS v3 6.1

EPSS 0.0025

EPSS Percentile 16.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Published Aug 03, 2026

Tracked Since Aug 04, 2026