CVE-2026-40565: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in freescout-help-desk freescout
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, FreeScout's linkify() function in app/Misc/Helper.php converts plain-text URLs in email bodies into HTML anchor tags without escaping double-quote characters (") in the URL. HTMLPurifier (called first via getCleanBody()) preserves literal " characters in text nodes. linkify() then wraps URLs including those " chars inside an unescaped href="..." attribute, breaking out of the href and injecting arbitrary HTML attributes. Version 1.8.213 fixes the issue.
AI Analysis
Technical Summary
CVE-2026-40565 is a cross-site scripting vulnerability in FreeScout's linkify() function located in app/Misc/Helper.php. The function converts plain-text URLs in email bodies into HTML anchor tags but fails to escape double-quote characters within URLs. HTMLPurifier preserves these literal double-quotes, which linkify() then includes unescaped inside href attributes, allowing attackers to inject arbitrary HTML attributes. This vulnerability affects FreeScout versions before 1.8.213 and is resolved in version 1.8.213.
Potential Impact
An attacker can exploit this vulnerability to inject arbitrary HTML attributes via crafted URLs in email bodies, potentially leading to cross-site scripting attacks. This can result in limited confidentiality and integrity impacts, such as executing malicious scripts in the context of the victim's browser. There is no impact on availability reported. The CVSS score of 6.1 reflects a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed.
Mitigation Recommendations
Upgrade FreeScout to version 1.8.213 or later, where this vulnerability is fixed. Since the vendor advisory indicates the issue is resolved in this version, applying this official fix is the recommended remediation. Patch status is confirmed by the version update note; no alternative mitigations are indicated.
CVE-2026-40565: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in freescout-help-desk freescout
Description
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, FreeScout's linkify() function in app/Misc/Helper.php converts plain-text URLs in email bodies into HTML anchor tags without escaping double-quote characters (") in the URL. HTMLPurifier (called first via getCleanBody()) preserves literal " characters in text nodes. linkify() then wraps URLs including those " chars inside an unescaped href="..." attribute, breaking out of the href and injecting arbitrary HTML attributes. Version 1.8.213 fixes the issue.
CVSS v3.1
Score 6.1medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-40565 is a cross-site scripting vulnerability in FreeScout's linkify() function located in app/Misc/Helper.php. The function converts plain-text URLs in email bodies into HTML anchor tags but fails to escape double-quote characters within URLs. HTMLPurifier preserves these literal double-quotes, which linkify() then includes unescaped inside href attributes, allowing attackers to inject arbitrary HTML attributes. This vulnerability affects FreeScout versions before 1.8.213 and is resolved in version 1.8.213.
Potential Impact
An attacker can exploit this vulnerability to inject arbitrary HTML attributes via crafted URLs in email bodies, potentially leading to cross-site scripting attacks. This can result in limited confidentiality and integrity impacts, such as executing malicious scripts in the context of the victim's browser. There is no impact on availability reported. The CVSS score of 6.1 reflects a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed.
Mitigation Recommendations
Upgrade FreeScout to version 1.8.213 or later, where this vulnerability is fixed. Since the vendor advisory indicates the issue is resolved in this version, applying this official fix is the recommended remediation. Patch status is confirmed by the version update note; no alternative mitigations are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-14T13:24:29.473Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69e79f4219fe3cd2cde2398a
Added to database: 4/21/2026, 4:01:06 PM
Last enriched: 4/21/2026, 4:16:03 PM
Last updated: 6/3/2026, 7:54:46 AM
Views: 53
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.