PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-48229 Open ISES CVE debrief

CVE-2026-48229 is a reflected cross-site scripting vulnerability in Open ISES Tickets versions before 3.44.2. The supplied advisory states that routes_i.php accepts an unsanitized ticket_id GET parameter and reflects it into HTML hidden input value attributes, allowing attacker-supplied JavaScript to execute in a victim's browser when the page renders. The linked fix is associated with the 3.44.2 release.

Vendor
Open ISES
Product
Tickets
CVSS
MEDIUM 5.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-21
Original CVE updated
2026-07-23
Advisory published
2026-05-21
Advisory updated
2026-07-23

Who should care

Administrators and operators of Open ISES Tickets instances running versions earlier than 3.44.2 should prioritize this issue, along with application security teams and anyone responsible for the ticket workflow UI and server-side input handling.

Technical summary

The vulnerable code path is routes_i.php. According to the supplied description, the application reflects the ticket_id query parameter into a hidden input value without proper output encoding or sanitization. That creates a reflected XSS condition in a browser-rendered page. The provided references point to a fixing Git commit and the v3.44.2 release tag, which together indicate the patched version line.

Defensive priority

Medium. Apply the vendor fix promptly if you run an affected version, because this is a browser-executed XSS issue in a web application path, even though it is not listed as a KEV item.

Recommended defensive actions

  • Upgrade Open ISES Tickets to version 3.44.2 or later.
  • Confirm that the deployed build includes the fix referenced by the linked Git commit and release tag.
  • Review routes_i.php and adjacent rendering paths for proper HTML attribute escaping of all reflected request parameters.
  • Temporarily restrict access to the affected ticket interface if you cannot patch immediately.
  • Monitor for unusual requests containing crafted ticket_id values and review application logs for suspicious browser-side behavior.

Evidence notes

The supplied NVD source item shows CVE-2026-48229 with a last-modified timestamp of 2026-05-21 and a vulnStatus of 'Deferred'. The referenced materials include a GitHub commit, the v3.44.2 release tag, and a Vulncheck advisory titled around reflected XSS via routes_i.php and the ticket_id parameter. The supplied vulnerability description identifies CWE-79 and states the issue affects Open ISES Tickets before 3.44.2.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-48229 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-48229

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-48229 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-48229

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.