PT-2026-34010 · Freescout · Freescout

Published 2026-04-21 · Updated 2026-04-21 · CVE-2026-40566

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.213

Description A Server-Side Request Forgery (SSRF) issue exists in the IMAP/SMTP connection test functionality of the MailboxesController. Three AJAX actions, 'fetch test', 'send test', and 'imap folders' in app/Http/Controllers/MailboxesController.php, pass admin-configured in server, in port, out server, and out port values directly to fsockopen() via Helper::checkPort() and to IMAP/SMTP client connections without protection. The system lacks IP validation, hostname restrictions, internal range blocklists, and does not utilize sanitizeRemoteUrl() or checkUrlIpAndHost() functions. An authenticated administrator can configure a mailbox to point to any internal host and port to trigger connection tests. This allows for internal network port scanning and service fingerprinting, as the server opens raw TCP and protocol-level connections. In cloud environments, this can be used to probe the metadata endpoint at '169.254.169.254', potentially leaking partial response data through protocol error messages.

Recommendations Update to version 1.8.213.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-40566

Affected Products

Freescout

References · 6

• 🔥 https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-fg98-rgx6-8x4g · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-40566 · Security Note
• https://github.com/freescout-help-desk/freescout/commit/efe82e31b4a0d4c0b20025d09df0615e8139ff08 · Note
• https://github.com/freescout-help-desk/freescout/releases/tag/1.8.213 · Note
• https://twitter.com/infoflowcloud/status/2046637725399269525 · Twitter Post
• https://twitter.com/CVEnew/status/2046636258697392585 · Twitter Post