PatchSiren cyber security CVE debrief
CVE-2026-48213 Open ISES CVE debrief
CVE-2026-48213 is a reflected cross-site scripting issue in Open ISES Tickets prior to version 3.44.2. The problem is in add.php, where an unsanitized ticket_id POST value is inserted into an HTML form input value attribute. An authenticated attacker can send a crafted request so that malicious JavaScript executes in the victim’s browser when the response is rendered.
- Vendor
- Open ISES
- Product
- Tickets
- CVSS
- MEDIUM 5.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-21
- Original CVE updated
- 2026-05-21
- Advisory published
- 2026-05-21
- Advisory updated
- 2026-05-21
Who should care
Administrators and security teams running Open ISES Tickets, especially deployments that expose add.php to authenticated users. Any organization that allows lower-trust or broad internal users to interact with ticket creation workflows should treat this as a browser-side injection risk.
Technical summary
The vulnerable flow reflects user-controlled ticket_id data into HTML without proper sanitization or encoding. Because the value lands in an attribute context, a crafted payload can break out of the intended value and execute script in the browser. The issue is tracked as CWE-79 and is fixed in Open ISES Tickets v3.44.2 per the referenced release and commit.
Defensive priority
Medium. The issue requires authentication and user interaction, but successful exploitation can execute script in a victim session and enable phishing, session abuse, or unauthorized actions in the application context.
Recommended defensive actions
- Upgrade Open ISES Tickets to version 3.44.2 or later.
- Review any backports, forks, or customizations to confirm the ticket_id value is HTML-escaped before rendering in add.php.
- Validate that other request parameters are not reflected into HTML attribute contexts without encoding.
- Use layered browser defenses where practical, such as a restrictive Content Security Policy and secure cookie settings.
- If immediate upgrade is not possible, limit access to the affected authenticated workflow to the smallest practical user set.
Evidence notes
The NVD record for CVE-2026-48213 cites a VulnCheck disclosure and references a fixing commit plus the v3.44.2 release tag. The CVE description states the flaw affects Open ISES Tickets before 3.44.2 and that the vulnerable sink is add.php with the ticket_id POST parameter. NVD currently marks the vulnerability status as Deferred in the provided source item.
Official resources
Publicly disclosed on 2026-05-21 in the referenced VulnCheck advisory and reflected in the NVD entry the same day. The available references point to a fix commit and the Open ISES Tickets v3.44.2 release.