Cross-Site Scripting Vulnerability in FreeScout Help Desk Software

CVE-2026-62854

What is CVE-2026-62854?

Prior to version 1.8.225, FreeScout, a self-hosted help desk and shared mailbox solution, contained a vulnerability that allowed users with permission to edit a mailbox signature to execute an external script. By exploiting this flaw, a malicious user could upload a scriptable file through the /uploads/upload endpoint, utilizing nested tag fragments to bypass security measures. This external script, which is served from the same origin, executes under the privileges of the affected user when they access the mailbox reply editor or the new ticket page, allowing unauthorized access to visible data and the ability to perform same-origin actions. The issue was addressed in FreeScout version 1.8.225.

References