Stored HTML Injection Vulnerability in LibreDesk Customer Support Desk

CVE-2025-68927

What is CVE-2025-68927?

LibreDesk, a self-hosted customer support desk application, is susceptible to a stored HTML injection vulnerability in its contact notes feature. An attacker can exploit this vulnerability during the note submission process, where user input is improperly sanitized. By intercepting the API request to add contact notes and modifying it to remove the automatically added HTML paragraph tags, an attacker can inject malicious HTML elements. This can enable various attacks, such as phishing and CSRF-style actions, leading to potential unauthorized access or manipulation of the user interface. Users are advised to update to version 0.8.6-beta, where the vulnerability has been addressed.

References