PT-2026-33815 · Gfi · Gfi Helpdesk

Alex Williams + 1 · Published 2026-04-20 · Updated 2026-04-21 · CVE-2026-23758

Positive Technologies (AI Summary)

CVSS v4.0

6.4

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions GFI HelpDesk versions prior to 4.99.9

Description A stored cross-site scripting issue exists in the ticket subject field. Authenticated staff members can inject malicious JavaScript by manipulating the 'editsubject' POST parameter. This occurs due to inadequate sanitization in the Controller Ticket.EditSubmit() function, which bypasses the incomplete SanitizeForXSS() method, allowing arbitrary JavaScript execution when other staff members or administrators view the affected ticket.

Recommendations Update to version 4.99.9 or later. As a temporary workaround, restrict access to the Controller Ticket.EditSubmit() function or the 'editsubject' parameter to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-23758

Affected Products

Gfi Helpdesk

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-23758 · Security Note
• https://gfi.ai/products-and-solutions/email-and-messaging-solutions/helpdesk/resources/product-releases · Patch, Vendor Advisory
• https://vulncheck.com/advisories/gfi-helpdesk-stored-xss-via-editsubject-parameter · Note
• https://twitter.com/VulmonFeeds/status/2046326040402739524 · Twitter Post
• https://twitter.com/CVEnew/status/2046571916052562347 · Twitter Post