Preliminary research

Ticket to Shell: Exploiting PHP Filters and CNEXT in osTicket (CVE-2026-22200)

Naveen Sunkavally · Horizon3.ai · 22 January 2026

AI-collected research leads through 2 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

Combines an osTicket sanitizer differential with an old mPDF parser so PHP filter chains embed arbitrary local files into exported ticket PDFs. The article fingerprints libc through `/proc/self/maps` and applies the CNEXT technique to turn the read into a web-shell write.

Record

Researcher

Naveen Sunkavally

Published by

Horizon3.ai

Date

22 January 2026

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• PoC

Tags

• php
• sanitizer-bypass
• parser-differential
• file-read
• file-write
• pdf
• attack-chain
• rce
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Naveen Sunkavally, first published at the original source. Preserved copies are kept so the citation survives its host.