CVE-2026-38446 describes a stored XSS vulnerability in osTicket 1.18.3 caused by insufficient sanitization of the thread entry title field. User-controlled input in the title is stored and rendered in multiple staff-facing templates without proper HTML escaping or output encoding. This flaw enables attackers to inject malicious JavaScript code via crafted ticket replies or emails with malicious subject lines, potentially impacting staff users who view these entries.

The vulnerability allows an attacker to execute arbitrary JavaScript in the context of staff users viewing the affected ticket entries. This could lead to session hijacking, unauthorized actions, or other client-side attacks against staff members. There is no information about known exploits in the wild. The impact is limited to staff-facing interfaces where the malicious input is rendered.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid opening or interacting with suspicious ticket replies or emails with unusual subject lines. Implementing additional output encoding or input sanitization on the thread entry title field may mitigate the risk. Monitor vendor channels for updates and apply patches once released.