CVE-2026-62854

FreeScout is a self-hosted help desk and shared mailbox.

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, a user who can edit a mailbox signature can combine a scriptable file uploaded through /uploads/upload with nested tag fragments that bypass Helper::stripDangerousTags(). The resulting external script is served from the same origin, so the script-src 'self' policy permits it when another user opens the affected mailbox reply editor or new-ticket page. The script executes with the victim's FreeScout…

6. Nov 2026

Ausgewertete Quellen

• NVD
  CVE-2026-62854