---
id: 10186
title: "Ticket to Shell: Exploiting PHP Filters and CNEXT in osTicket (CVE-2026-22200)"
cve: CVE-2026-22200
source_domain: horizon3.ai
source_url: "https://horizon3.ai/attack-research/attack-blogs/ticket-to-shell-exploiting-php-filters-and-cnext-in-osticket-cve-2026-22200/"
published_at: "2026-01-22T15:51:08Z"
tags: ["rce", "vulnerability-research"]
phying_url: "https://phying.com/item/10186"
lang: en
---

# Ticket to Shell: Exploiting PHP Filters and CNEXT in osTicket (CVE-2026-22200)

## Summary

CVE-2026-22200 impacts osTicket and lets anonymous attackers read arbitrary files and, in some cases, achieve RCE. Patched in osTicket 1.18.3 / 1.17.7.

## Intelligence Metadata

- **Sources:** horizon3.ai
- **CVE:** CVE-2026-22200
- **Published:** 2026-01-22T15:51:08Z
- **Original:** https://horizon3.ai/attack-research/attack-blogs/ticket-to-shell-exploiting-php-filters-and-cnext-in-osticket-cve-2026-22200/
- **Phying News:** https://phying.com/item/10186