CVE-2026-34442
MEDIUM
5,4
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: low
Integrity: low
Availability: none
Description
AI Translation Available
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.211, host header manipulation in FreeScout version (http://localhost:8080/system/status) allows an attacker to inject an arbitrary domain into generated absolute URLs. This leads to External Resource Loading and Open Redirect behavior. When the application constructs links and assets using the unvalidated Host header, user requests can be redirected to attacker-controlled domains and external resources may be loaded from malicious servers. This issue has been patched in version 1.8.211.
20
Improper Input Validation
StableCommon Consequences
Security Scopes Affected:
Availability
Confidentiality
Integrity
Potential Impacts:
Dos: Crash, Exit, Or Restart
Dos: Resource Consumption (Cpu)
Dos: Resource Consumption (Memory)
Read Memory
Read Files Or Directories
Modify Memory
Execute Unauthorized Code Or Commands
Applicable Platforms
All platforms may be affected
601
URL Redirection to Untrusted Site ('Open Redirect')
DraftCommon Consequences
Security Scopes Affected:
Access Control
Confidentiality
Other
Potential Impacts:
Bypass Protection Mechanism
Gain Privileges Or Assume Identity
Other
Applicable Platforms
Technologies:
Web Based, Web Server
829
Inclusion of Functionality from Untrusted Control Sphere
IncompleteCommon Consequences
Security Scopes Affected:
Confidentiality
Integrity
Availability
Potential Impacts:
Execute Unauthorized Code Or Commands
Applicable Platforms
All platforms may be affected
https://github.com/freescout-help-desk/freescout/commit/889d75c8e3c15e6a7ddb6a4…
https://github.com/freescout-help-desk/freescout/releases/tag/1.8.211
https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-822g-…