Read the docs
TI-2026-25245 Aliases CVE-2026-32754

FreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!})

Priority HIGH 75CWE-116Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Versions 1.8.208 and below are vulnerable to Stored Cross-Site Scripting (XSS) through FreeScout's email notification templates. Incoming email bodies are stored in the database without sanitization and rendered unescaped in outgoing email notifications using Blade's raw output syntax {!! $thread->body !!}. An unauthenticated attacker can exploit this vulnerability by simply sending an email, and when opened by any subscribed agent or admin as part of their normal workflow, enabling universal HTML injection (phishing, tracking) and, in vulnerable email clients, JavaScript execution (session hijacking, credential theft, account takeover) affecting all recipients simultaneously. This issue has been fixed in version 1.8.209.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0056 46th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed freescout (freescout-help-desk): 1.8.209

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
freescout-help-deskfreescoutbefore 1.8.2091.8.209Patch availableCNA
  • freescout Vendorfreescout-help-desk Affected before 1.8.209 Fixed in 1.8.209 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:freescout:freescout:*:*:*:*:*:*:*:*before 1.8.209Vulnerablefreescout-help-desk
  • cpe:2.3:a:freescout:freescout:*:*:*:*:*:*:*:* Versions before 1.8.209 Vulnerable ·freescout-help-desk

Remediation

  • Fix · CNA freescout (freescout-help-desk) Fixed in 1.8.209

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-32754
  2. 2026-10-23 EPSS moved to the 50th–90th percentile
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Exploit 1

Patch 1

Other 1

  • TI-2026-22019 FreeScout's Predictable Authentication Token Enables Account Takeover CVSS 3.1CRITICAL 9.8
  • TI-2026-29249 FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron CVSS 4.0HIGH 8.9
  • TI-2026-29247 FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force CVSS 4.0HIGH 8.8
  • TI-2026-22596 FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution CVSS 3.1CRITICAL 10.0
  • TI-2024-19354 FreeScout OS Command Injection vulnerability CVSS 3.1CRITICAL 9.1
  • TI-2026-22018 FreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on Apache CVSS 3.1HIGH 8.8
See all 45 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences