EIP-2026-110407

PRE-CVE

osTicket 1.x - 'Open_form.php' Remote File Inclusion

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-110407. PoCs published by Sweet.

AI-analyzed exploit summary The provided text describes a remote file inclusion vulnerability in osTicket, where unsanitized user input allows an attacker to include and execute arbitrary remote PHP code. The example URL demonstrates how an attacker could exploit this to execute system commands.

Description

osTicket 1.x - 'Open_form.php' Remote File Inclusion

Exploits (1)

exploitdb WRITEUP VERIFIED
by Sweet · textwebappsphp
https://www.exploit-db.com/exploits/27928

The provided text describes a remote file inclusion vulnerability in osTicket, where unsanitized user input allows an attacker to include and execute arbitrary remote PHP code. The example URL demonstrates how an attacker could exploit this to execute system commands.

Classification
Writeup 80%
Attack Type
Rce
Complexity
Trivial
Reliability
Theoretical
Target: osTicket (version not specified)
No auth needed
Prerequisites: Network access to the target application · Ability to host a malicious PHP script on a remote server
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026