Description

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, a user who can edit a mailbox signature can combine a scriptable file uploaded through /uploads/upload with nested tag fragments that bypass Helper::stripDangerousTags(). The resulting external script is served from the same origin, so the script-src 'self' policy permits it when another user opens the affected mailbox reply editor or new-ticket page. The script executes with the victim's FreeScout privileges and can read visible data and perform same-origin actions. This issue is fixed in version 1.8.225.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-11-06T17:18:33.700Z",
  "pubdate": "2026-11-06T17:18:33.700Z",
  "executiveSummary": "A Stored Cross-Site Scripting (XSS) vulnerability exists in FreeScout versions prior to 1.8.225, stemming from insufficient sanitization of mailbox signatures.\nBy leveraging a flaw in the Helper::stripDangerousTags() function, an authenticated attacker with mailbox editing privileges can inject malicious JavaScript payloads that bypass security filters.\nThe vulnerability allows for the execution of arbitrary scripts within the context of a victim's session. Because the malicious payload is hosted on the same origin, it successfully bypasses content security policy restrictions governing script execution.\nSuccessful exploitation enables an attacker to perform unauthorized actions on behalf of the victim, access sensitive help desk data, or hijack user sessions.\nThis vulnerability requires the attacker to have existing privileges to edit mailbox signatures, limiting the attack surface to authenticated users within the application environment.\nThe risk is categorized as high, as it facilitates unauthorized interaction with internal application functions and data retrieval from the victim's session context.",
  "technicalDetails": "The root cause of this vulnerability is a bypass of the input sanitization logic implemented in the Helper::stripDangerousTags() function. The application relies on this function to strip potentially malicious tags and attributes from user-supplied content, specifically within mailbox signatures.\nThe exploitation process begins with the attacker uploading a scriptable file via the /uploads/upload endpoint. Although the system is designed to sanitize incoming content, the attacker can use specially crafted, nested tag fragments that circumvent the regex or parsing logic utilized by Helper::stripDangerousTags(). By nesting these tags, the attacker tricks the filter into incorrectly validating the malicious script as harmless content.\nOnce the payload is successfully stored as part of a mailbox signature, it resides within the application's database. When a victim, such as a support agent, accesses the affected mailbox reply editor or a new-ticket page, the application renders the contaminated signature. Because the malicious script is served from the same origin as the FreeScout instance, the browser's script-src 'self' policy treats the injected script as trusted, authorized code.\nUpon execution, the script runs with the full privileges of the victim's session. The attacker can then programmatically interact with the Document Object Model (DOM) to exfiltrate visible data, manipulate tickets, alter application settings, or perform other state-changing actions within the scope of the victim's authenticated session.\nThis vulnerability is restricted to versions prior to 1.8.225. Authentication is a prerequisite, as the attacker must possess the ability to edit mailbox signatures to insert the payload. As the application is self-hosted, the network exposure is typically limited to the organization's internal or public-facing deployment of FreeScout. The post-exploitation impact is severe, as it permits full session-level interaction, potentially leading to unauthorized data exposure or administrative escalation if the victim holds high-level privileges within the help desk system."
}