CVE-2026-22200 is an arbitrary file read vulnerability in Enhancesoft osTicket affecting versions 1.18.x before 1.18.3 and 1.17.x before 1.17.7. The issue arises from insufficient sanitization of PHP filter expressions in rich-text HTML submitted in tickets. During PDF export, the mPDF generator processes these expressions, enabling an attacker to embed contents of arbitrary server files as images in the generated PDF. This results in unauthorized disclosure of local files within the context of the osTicket application user. The vulnerability can be exploited remotely without authentication in default configurations where guests can create tickets or self-registration is enabled.

Successful exploitation allows remote attackers to read arbitrary files on the server by embedding their contents into exported ticket PDFs. This can lead to disclosure of sensitive local files accessible to the osTicket application user context. The vulnerability requires no privileges or user interaction and has a high CVSS score of 8.7, indicating a significant risk of information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict guest ticket creation and disable self-registration if possible to reduce exposure. Monitor vendor channels for updates and apply patches promptly once released.