Enhancesoft osTicket versions 1.18.x earlier than 1.18.3 and 1.17.x earlier than 1.17.7 expose an arbitrary file read flaw in their PDF export routine. The flaw arises because rich‑text HTML in submitted tickets is processed by the mPDF generator without proper sanitization of PHP filter expressions. When an attacker creates a ticket with crafted HTML and later triggers a PDF export, the resulting document can embed the contents of any files chosen by the attacker from the server’s local filesystem as bitmap images, leaking sensitive data to the application user who views the PDF. This vulnerability is tied to CWE-74, which describes improper handling of data via input that can influence system behavior.

The affected vendor is Enhancesoft, specifically the osTicket ticket management application. Versions 1.18.x before 1.18.3 and 1.17.x before 1.17.7 are vulnerable. No other versions or additional vendors were identified from the CNA data.

The CVSS score of 8.7 indicates a high severity impact, and an EPSS rating of 75% suggests a high probability of exploitation in real-world scenarios. Although the flaw is not listed in the CISA KEV catalog, the default configuration of many installations allows guests or self‑registered users to submit tickets and obtain export, thereby giving an attacker a straightforward remote entry path. The lack of mandatory sanitization makes the vulnerability easy to exploit once a ticket is created, leading to privileged disclosure of local files within the application context.