CVE-2026-48228 Open ISES CVE debrief

Who should care

Administrators and security teams running Open ISES Tickets deployments prior to 3.44.2, especially where authenticated users can be targeted with crafted links or internal web requests. Application defenders responsible for session protection, output encoding, and upgrade management should prioritize this issue.

Technical summary

The issue is a reflected XSS in patient_w.php caused by insufficient sanitization of the id and ticket_id GET parameters before they are inserted into an HTML form action URL. The attack requires user interaction and authenticated access, which matches the CVSS vector and keeps the severity in the medium range. The vendor-provided advisory and upstream release indicate the issue was addressed in version 3.44.2, with a corresponding commit in the openises/tickets repository.

Defensive priority

Medium. The issue is exploitable in the browser and can be used to run arbitrary JavaScript in a targeted authenticated session, but it requires user interaction and does not indicate direct server compromise. Prioritize patching if the application is internet-facing or used by high-trust operators.

Recommended defensive actions

• Upgrade Open ISES Tickets to version 3.44.2 or later.
• Review and validate the upstream fix in the referenced commit to confirm the vulnerable parameter handling is removed.
• Treat links or requests containing id and ticket_id parameters as suspicious until all instances are patched.
• Apply server-side output encoding and input validation for any remaining dynamic HTML generation in patient_w.php and related routes.
• Use a restrictive Content Security Policy to reduce the impact of any future client-side injection issues.
• Audit authentication-protected workflows for similar reflected output patterns and remediate consistently.

Evidence notes

The supplied source corpus identifies Open ISES Tickets before 3.44.2 as affected and cites a reflected XSS in patient_w.php involving unsanitized id and ticket_id parameters. The record references an upstream fix commit and the v3.44.2 release tag on GitHub, plus a VulnCheck advisory page. NVD metadata in the supplied corpus marks the CVE status as Deferred, and the weakness mapping provided by the disclosure is CWE-79. Vendor attribution in the input is low confidence and should be treated as tentative.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.