Stored cross-site scripting in FreeScout mailbox signature
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
FreeScout before 1.8.225 has a stored cross-site scripting flaw (CWE-79) in mailbox signatures. A user who can edit a signature can combine a scriptable uploaded file with nested tag fragments that bypass the tag filter, and the resulting script is served from the same origin so the script-src 'self' policy allows it. An attacker with low privileges can run script in the browser of another user who opens the affected mailbox reply editor or new-ticket page, with that user's FreeScout privileges.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, a user who can edit a mailbox signature can combine a scriptable file uploaded through /uploads/upload with nested tag fragments that bypass Helper::stripDangerousTags(). The resulting external script is served from the same origin, so the script-src 'self' policy permits it when another user opens the affected mailbox reply editor or new-ticket page. The script executes with the victim's FreeScout privileges and can read visible data and perform same-origin actions. This issue is fixed in version 1.8.225.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| freescout-help-desk | freescout | before 1.8.225 | 1.8.225 | Patch available | CNA |
- freescout Vendorfreescout-help-desk Affected before 1.8.225 Fixed in 1.8.225 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:freescout:freescout:*:*:*:*:*:*:*:* | — | — | freescout-help-desk |
- cpe:2.3:a:freescout:freescout:*:*:*:*:*:*:*:* Versions — — ·freescout-help-desk
Remediation
Upgrade FreeScout to version 1.8.225.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA freescout (freescout-help-desk) Fixed in 1.8.225
Timeline
- 2026-11-06 Threatist record created from CVE-2026-62854
- 2026-11-08 Priority changed: MEDIUM → LOW
References
Other 4
- https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jpq8-j69f-mj98
- https://github.com/freescout-help-desk/freescout/commit/315ad05f73886649cb8bc2c014dd74b62cc28502
- https://github.com/freescout-help-desk/freescout/commit/7f6a5042c1326ceaf511f13982178dce036cedbe
- https://github.com/freescout-help-desk/freescout/releases/tag/1.8.225
More freescout-help-desk vulnerabilities
- TI-2026-38652 FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL CVSS 3.1CRITICAL 9.4
- TI-2026-22019 FreeScout's Predictable Authentication Token Enables Account Takeover CVSS 3.1CRITICAL 9.8
- TI-2026-30304 FreeScout's user invitation hash never expires: permanent unauthenticated account takeover if invite link leaks CVSS 3.1CRITICAL 9.1
- TI-2026-29249 FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron CVSS 4.0HIGH 8.9
- TI-2026-29247 FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force CVSS 4.0HIGH 8.8
- TI-2026-38648 FreeScout Vulnerable to Unauthenticated Conversation Thread Injection via HMAC Length Bypass in FetchEmails CVSS 3.1HIGH 8.6
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences