PT-2025-53612 · Libredesk · Libredesk

Playeriunknown · Published 2025-12-22 · Updated 2025-12-27 · CVE-2025-68927

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Libredesk versions prior to 0.8.6-beta

Description Libredesk is a self-hosted customer support desk application. A stored HTML injection issue exists in the contact notes feature. When adding notes through the POST /api/v1/contacts/{id}/notes endpoint, user input is wrapped in

tags by the backend. Removing the

tag allows an attacker to inject arbitrary HTML elements, such as forms and images, which are then stored and displayed without proper sanitization. This can potentially lead to phishing, Cross-Site Request Forgery (CSRF)-style forced actions, and UI redress attacks. The vulnerable parameter is the contact note content submitted via the POST /api/v1/contacts/{id}/notes API endpoint.

Recommendations Update to version 0.8.6-beta or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-68927

GHSA-WH6M-H6F4-RJF4

GO-2025-4243

Affected Products

Libredesk

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68927.json · Exploit
• 🔥 https://github.com/abhinavxd/libredesk/security/advisories/GHSA-wh6m-h6f4-rjf4 · Exploit
• https://github.com/abhinavxd/libredesk/commit/270347849943ac6a43e9fd6ebdc99c71841900eb · Patch
• https://osv.dev/vulnerability/CVE-2025-68927 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4243 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68927 · Security Note
• https://t.me/CVEtracker/40738 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2004732668848558254 · Twitter Post
• https://twitter.com/CVEnew/status/2004868106615930979 · Twitter Post