CVE-2017-15580: Osticket

Critical severity, CVSS 9.8. EPSS: 15.6% chance of exploitation in the next 30 days.

osTicket 1.10.1 provides a functionality to upload 'html' files with associated formats. However, it does not properly validate the uploaded file's contents and thus accepts any type of file, such as with a tickets.php request that is modified with a .html extension changed to a .exe extension. An attacker can leverage this vulnerability to upload arbitrary files on the web application having malicious content.

Affected products

• Osticket Osticket: version 1.10.1 only

Published 2017-10-23. Last modified 2026-06-17.