CVE-2026-48222 Open ISES CVE debrief

Who should care

Administrators and developers running Open ISES Tickets deployments prior to 3.44.2 should prioritize this issue, especially if authenticated users can reach ics213.php or related ticket workflows. Security teams should also care because reflected XSS can affect user sessions and browser-side trust even when exploitation requires authentication and user interaction.

Technical summary

The vulnerable path is ics213.php, where the frm_add_str POST parameter is passed into an HTML form hidden input value attribute without proper output encoding. Because the payload is reflected into the response, an attacker can supply JavaScript-containing input that executes in the browser of a user who loads the crafted response. The CVSS vector supplied by the source indicates network attackability with required user interaction.

Defensive priority

Medium. The issue is exploitable remotely but requires authentication and user interaction, and it is addressed by the vendor release labeled 3.44.2. For most environments, upgrading to 3.44.2 or later should be the first remediation step.

Recommended defensive actions

• Upgrade Open ISES Tickets to version 3.44.2 or later.
• Review ics213.php and any related form rendering code for proper HTML output encoding.
• Validate that POST parameters are never written into HTML attributes without context-aware escaping.
• Add server-side input handling and output encoding checks to prevent reflected XSS regressions.
• Re-test the affected workflow after upgrading to confirm the reflected input is no longer executed in the browser.

Evidence notes

The vulnerability description, affected version boundary, weakness class, and fix reference are supported by the supplied NVD record and the referenced VulnCheck disclosure material. The source set includes a commit reference and a 3.44.2 release tag, which align with the stated remediation. NVD lists the record with vulnStatus set to Deferred, and the vendor metadata in the source set is low-confidence, so product identification should be treated as supported by the disclosure references rather than vendor attribution alone.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.