CVE-2026-38444

Name of the Vulnerable Software and Affected Versions osTicket version 1.18.3

Description Stored Cross-Site Scripting (XSS) occurs when the application fails to sanitize the email From-header display name. The value is extracted in the include/class.mailparse.php file and stored raw in the poster field of ost thread entry. An unauthenticated attacker can exploit this by sending a reply email to an existing ticket from an unregistered address containing an XSS payload in the From display name.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.