PT-2026-34012 · Freescout · Freescout

Published 2026-04-21 · Updated 2026-04-21 · CVE-2026-40568

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.213

Description A stored cross-site scripting (XSS) issue exists in the mailbox signature feature. The sanitization function Helper::stripDangerousTags() uses an incomplete blocklist of HTML tags and fails to remove event handler attributes. When a mailbox signature is saved via MailboxesController::updateSave(), HTML elements such as <img>, <svg>, and <details> containing event handler attributes like onerror and onload are stored in the database. These are later rendered as raw HTML, triggering the injected event handlers. Any authenticated user with the ACCESS PERM SIGNATURE permission can inject arbitrary HTML and JavaScript. The payload executes automatically when an agent or administrator opens a conversation in the affected mailbox, potentially leading to session hijacking, phishing overlays, email exfiltration via mass assignment, and self-propagating worm behavior.

Recommendations Update to version 1.8.213.

Exploit

Fix

XSS

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-79

CWE-116

Related Identifiers

CVE-2026-40568

Affected Products

Freescout

References · 6

• 🔥 https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-w2f5-6wcv-677r · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-40568 · Security Note
• https://github.com/freescout-help-desk/freescout/commit/1d83e1cffb0bf8d109625313530b36b0f5910b3f · Note
• https://github.com/freescout-help-desk/freescout/releases/tag/1.8.213 · Note
• https://twitter.com/infoflowcloud/status/2046637705476313546 · Twitter Post
• https://twitter.com/CVEnew/status/2046636255891406897 · Twitter Post