CVE-2026-62854 · Package
NO FIX YET · SEE WHAT TO DO
FreeScout, a self-hosted help desk, lets a user who can edit a mailbox signature upload a scriptable file and bypass tag stripping so the file loads as a script. When another user opens the affected mailbox reply editor or new-ticket page, the script runs with that user's FreeScout privileges, reading visible data and acting as them.
first public Jul 15, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running self-hosted FreeScout before 1.8.225 where some users can edit mailbox signatures. Exposure needs a user with signature-edit rights and another user opening the affected mailbox pages; hosted or patched installs can skip it.
Not affected if fixed-version-1.8.225, no-signature-editors
Who cares freescout, helpdesk, self-hosted
1.8.225 are affected.1.8.225.FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, a user who can edit a mailbox signature can combine a scriptable file uploaded through /uploads/upload with nested tag fragments that bypass Helper::stripDangerousTags(). The resulting external script is served from the same origin, so the script-src 'self' policy permits it when another user opens the affected mailbox reply editor or new-ticket page. The script executes with the victim's FreeScout privileges and can read visible data and perform same-origin actions. This issue is fixed in version 1.8.225.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.