Technical impact
This flaw in osTicket 1.18.3 lets an unauthenticated sender embed arbitrary JavaScript in the email "From" display name. The value is extracted without sanitization, stored in the ‘poster’ field, and rendered unescaped when the ticket is viewed. An attacker can thus run scripts in the browsers of any user who opens the ticket, allowing cookie theft, session hijacking, defacement or data exfiltration. The weakness is a classic stored XSS (CWE‑79).
Affected Systems
The vulnerability affects the osTicket product, specifically version 1.18.3 and any deployments that rely on the included class.mailparse.php to parse incoming emails. Because the flaw is in the core email handling code, all tickets that receive external replies are potentially vulnerable. No vendor or product identifiers are listed in the CNA data; the issue pertains to the affected osTicket release.
Risk and Exploitability
An attacker only needs to send an email with a crafted "From" display name to an existing ticket from an unregistered address – no account or authentication is required. The exploit path is trivial. The CVSS score of 6.1 classifies the vulnerability as moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Due to the straightforward exploitation route and lack of built‑in defenses, unpatched installations remain at high risk for XSS attacks that could compromise user session data or inject malicious scripts.
