CVE-2026-107393: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in freescout-help-desk freescout
Description
FreeScout versions prior to 1.8.235 have a cross-site scripting (XSS) vulnerability when the APP_CLOUDFLARE_IS_USED setting is enabled. The application trusts an unvalidated CF-Connecting-IP header during failed login attempts and stores this spoofed value in the activity log. The LogsMonitor component then inserts this value into administrator alert emails without proper HTML escaping, allowing injected HTML to execute when the email is viewed. This vulnerability is fixed in version 1.8.235.
CVSS v3.1
Score 6.1medium
Affected software
freescout-help-desk
freescout
pkg:github/freescout-help-desk/freescoutRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
FreeScout before version 1.8.235 improperly neutralizes input by trusting the CF-Connecting-IP header without validation during failed login attempts when APP_CLOUDFLARE_IS_USED is enabled. The spoofed header value is stored in activity logs and later included in administrator alert emails by LogsMonitor without HTML escaping, leading to cross-site scripting (CWE-79) and improper output neutralization (CWE-116). This allows injected HTML to execute in the context of the administrator's email client. The issue is resolved in version 1.8.235.
Potential Impact
An attacker can inject malicious HTML via the CF-Connecting-IP header during failed login attempts, which is then stored and included in administrator alert emails without proper escaping. This can lead to execution of arbitrary HTML/JavaScript in the administrator's email client, potentially compromising the administrator's session or exposing sensitive information. The CVSS score is 6.1 (medium severity), indicating a moderate impact on confidentiality and integrity with no impact on availability.
Mitigation Recommendations
Upgrade FreeScout to version 1.8.235 or later, where this vulnerability is fixed. Since this is a self-hosted product, administrators should apply the official patch promptly. No other mitigation is indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-07T21:07:54.989Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Is Cloud Service
- true
Threat ID: 6ac7feec2cdf04f656318be2
Added to database: 10/08/2026, 20:37:00 UTC
Last enriched: 10/08/2026, 21:05:12 UTC
Last updated: 10/09/2026, 00:28:13 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.