PT-2026-33996 · Freescout · Freescout

Published 2026-04-21 · Updated 2026-04-21 · CVE-2026-40565

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.213

Description The linkify() function in app/Misc/Helper.php converts plain-text URLs in email bodies into HTML anchor tags without escaping double-quote characters (") in the URL. Because HTMLPurifier preserves literal double-quote characters in text nodes via getCleanBody(), the linkify() function wraps URLs containing these characters inside an unescaped href attribute. This allows for the injection of arbitrary HTML attributes by breaking out of the href attribute.

Recommendations Update to version 1.8.213.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-40565

Affected Products

Freescout

References · 6

• 🔥 https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-49pm-xwqj-vwjp · Exploit
• https://github.com/freescout-help-desk/freescout/commit/265379b3ae343f06846adc0aa8510643d1eac2df · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40565 · Security Note
• https://github.com/freescout-help-desk/freescout/releases/tag/1.8.213 · Note
• https://twitter.com/infoflowcloud/status/2046637677353582839 · Twitter Post
• https://twitter.com/CVEnew/status/2046636259632660973 · Twitter Post