Description

django-helpdesk before 2.3.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by submitting HTML-formatted email messages or uploading .html/.htm file attachments through public ticket submission channels. Attackers can exploit the lack of sanitization and Content-Disposition headers at the attachment-serving layer to execute malicious scripts in the browser session of authenticated staff members who open the attachment while triaging tickets.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-13T20:17:29.747Z",
  "pubdate": "2026-08-13T20:17:29.747Z",
  "executiveSummary": "A stored cross-site scripting vulnerability exists in django-helpdesk before 2.3.3, arising from inadequate sanitization of user-supplied inputs and missing Content-Disposition security headers within the attachment-serving layer. The vulnerability allows unauthenticated remote attackers to inject arbitrary JavaScript payloads via HTML-formatted email messages or maliciously crafted .html and .htm file attachments submitted through public ticket creation vectors. Successful exploitation compromises authenticated staff members during the ticket triage process, resulting in the execution of arbitrary script content within the context of the victim's active browser session. This condition poses significant risk to organizational confidentiality and integrity, potentially enabling session hijacking, unauthorized data exfiltration, or administrative action tampering within the support ticketing system.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of robust input sanitization and output encoding mechanisms applied to incoming email payloads and file attachments processed through public ticket submission channels in django-helpdesk before 2.3.3. Specifically, the attachment-serving layer fails to enforce secure Content-Disposition response headers, such as attachment with appropriate MIME-type restrictions or inline blocking, which causes browsers to render HTML files directly rather than downloading them securely.\nThe exploitation method leverages unauthenticated network exposure via public-facing ticket submission mechanisms. An attacker can craft and submit either an HTML-formatted email message or a standalone .html or .htm file attachment containing malicious JavaScript payloads. Because these submission vectors do not require authentication or elevated privileges, any external entity can interact with the public ticket intake interface.\nThe attack flow proceeds in a sequential manner: first, the unauthenticated attacker transmits the malicious payload via email or file upload to the public ticket submission channel. The django-helpdesk application ingests and stores the payload within the database without proper sanitization. Subsequently, an authenticated staff member accesses the helpdesk interface to review and triage tickets. When the staff member navigates to the ticket and interacts with the attachment-serving layer to view the uploaded .html or .htm file, the application serves the resource without enforcing defensive Content-Disposition headers.\nAs a result, the victim's browser interprets the server response as an HTML document and executes the embedded malicious JavaScript payload within the security context and active session of the authenticated user. Post-exploitation impact includes the potential execution of unauthorized actions on behalf of the staff member, access to sensitive ticket data, session token theft, or further lateral movement within the application framework."
}