Read the docs
TI-2026-26707 Aliases CVE-2026-34442

FreeScout: Host Header Injection Leading to External Resource Loading and Open Redirect in FreeScout

Priority MEDIUM 60CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing, Code execution
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-601 and CWE-829.

Summary

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.211, host header manipulation in FreeScout version (http://localhost:8080/system/status) allows an attacker to inject an arbitrary domain into generated absolute URLs. This leads to External Resource Loading and Open Redirect behavior. When the application constructs links and assets using the unvalidated Host header, user requests can be redirected to attacker-controlled domains and external resources may be loaded from malicious servers. This issue has been patched in version 1.8.211.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00223 13th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed freescout (freescout-help-desk): 1.8.211

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
freescout-help-deskfreescoutbefore 1.8.2111.8.211Patch availableCNA
  • freescout Vendorfreescout-help-desk Affected before 1.8.211 Fixed in 1.8.211 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:freescout:freescout:*:*:*:*:*:*:*:*before 1.8.211Vulnerablefreescout-help-desk
  • cpe:2.3:a:freescout:freescout:*:*:*:*:*:*:*:* Versions before 1.8.211 Vulnerable ·freescout-help-desk

Remediation

  • Fix · CNA freescout (freescout-help-desk) Fixed in 1.8.211

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34442

References

Exploit 1

Patch 1

Other 1

  • TI-2026-22019 FreeScout's Predictable Authentication Token Enables Account Takeover CVSS 3.1CRITICAL 9.8
  • TI-2026-29249 FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron CVSS 4.0HIGH 8.9
  • TI-2026-29247 FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force CVSS 4.0HIGH 8.8
  • TI-2026-25245 FreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!}) CVSS 3.1CRITICAL 9.3
  • TI-2026-22596 FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution CVSS 3.1CRITICAL 10.0
  • TI-2024-19354 FreeScout OS Command Injection vulnerability CVSS 3.1CRITICAL 9.1
See all 45 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences