CVE-2026-38446

Name of the Vulnerable Software and Affected Versions osTicket version 1.18.3

Description A stored cross-site scripting (XSS) issue occurs due to improper sanitization of the thread entry title field. User-controlled input in the title is stored without adequate HTML escaping and subsequently rendered in several staff-facing templates without proper output encoding. This allows an attacker to inject arbitrary JavaScript by submitting a crafted ticket reply or an email containing a malicious subject line.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.