PT-2026-33814 · Gfi · Gfi Helpdesk

Alex Williams + 1 · Published 2026-04-20 · Updated 2026-04-21 · CVE-2026-23756

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GFI HelpDesk versions prior to 4.99.9

Description A stored cross-site scripting issue exists in the Troubleshooter module. An authenticated staff member can inject arbitrary JavaScript into the step subject field because the POST parameter 'subject' is not sanitized in the functions Controller Step.InsertSubmit() and EditSubmit() before being rendered by View Step.RenderViewSteps(). The payload executes when a user navigates to Troubleshooter > View Troubleshooter and clicks the affected step link.

Recommendations Update to version 4.99.9 or later. As a temporary workaround, restrict access to the Troubleshooter module for staff members who do not require it.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-23756

Affected Products

Gfi Helpdesk

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-23756 · Security Note
• https://twitter.com/VulmonFeeds/status/2046331159819289020 · Twitter Post
• https://twitter.com/CVEnew/status/2046571915163406801 · Twitter Post
• https://vulncheck.com/advisories/gfi-helpdesk-stored-xss-via-troubleshooter-step-subject · Note
• https://gfi.ai/products-and-solutions/email-and-messaging-solutions/helpdesk/resources/product-releases · Patch, Vendor Advisory