TI-2026-51631 Aliases CVE-2026-73531 GHSA-67qv-r9gc-cpwj

django-helpdesk < 2.3.3 Stored XSS via HTML Attachments

LOW 30CWE-79Published 2026-08-13 · Updated 2026-08-14

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: None · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

django-helpdesk before 2.3.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by submitting HTML-formatted email messages or uploading .html/.htm file attachments through public ticket submission channels. Attackers can exploit the lack of sanitization and Content-Disposition headers at the attachment-serving layer to execute malicious scripts in the browser session of authenticated staff members who open the attachment while triaging tickets.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00286 21st percentileScored 2026-11-07

Fix Fixed django-helpdesk (django-helpdesk): 2.3.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
django-helpdesk	django-helpdesk	before 2.3.3	2.3.3	Patch available	CNA

django-helpdesk Vendordjango-helpdesk Affected before 2.3.3 Fixed in 2.3.3 Patch available CNA

Remediation

Fix · CNA django-helpdesk (django-helpdesk) Fixed in 2.3.3

Timeline

2026-10-02 Threatist record created from CVE-2026-73531
2026-10-03 Alias added: GHSA-67qv-r9gc-cpwj

References

Advisory 1

GitHub Security Advisory (GHSA-q46c-8w98-fq2g)

TI-2018-15337 django-helpdesk before 1.0.0 allows Sensitive Data Exposure because of os.umask(0) in models.py. CVSS 3.1MEDIUM 5.1
TI-2021-02891 Cross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdesk CVSS 3.1CRITICAL 9.6
TI-2021-02849 Cross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdesk CVSS 3.1MEDIUM 6.1
TI-2021-02852 Cross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdesk CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences