HIGH 7.6 NVD
CVE-2026-62854
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, a user who can edit a mailbox signature can combine a scriptable file uploaded throug
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, a user who can edit a mailbox signature can combine a scriptable file uploaded through /uploads/upload with nested tag fragments that bypass Helper::stripDangerousTags(). The resulting external script is served from the same origin, so the script-src 'self' policy permits it when another user opens the affected mailbox reply editor or new-ticket page. The script executes with the victim's FreeScout privileges and can read visible data and perform same-origin actions. This issue is fixed in version 1.8.225.
References
- https://github.com/freescout-help-desk/freescout/commit/315ad05f73886649cb8bc2c014dd74b62c
- https://github.com/freescout-help-desk/freescout/commit/7f6a5042c1326ceaf511f13982178dce03
- https://github.com/freescout-help-desk/freescout/releases/tag/1.8.225
- https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jpq8-j69f-mj98
This high severity vulnerability with a CVSS score of 7.6 was published on 2026-11-06 via NVD.
vulnfeed aggregates 16326 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.